Here is an uncomfortable exercise. Pick someone who has worked at your business for five years and has changed roles once or twice. Now list every system, folder, and shared mailbox they can open today. Most owners cannot do it, and the ones who try are usually surprised by the answer.
This is access creep, and it is one of the most common findings in any security review.
How it happens without anyone doing anything wrong
Nobody sets out to over-permission their staff. It accumulates:
- Someone covers for a colleague on leave and is given access to their folders. The colleague comes back; the access stays.
- A person moves from operations into sales and gets the sales systems added. Nothing is taken away.
- A project needs three people in a finance folder for a month. The project ends. The folder does not.
- It is quicker to copy an existing user’s permissions when creating a new account than to work out what the role actually needs.
Each decision was reasonable at the time. The aggregate is a business where a large share of staff can open things that have nothing to do with their job.
Why it matters more than it sounds
The obvious worry is a disgruntled employee, and that does happen. But the everyday risks are more mundane and more likely.
One compromised account becomes a company-wide incident. When an attacker phishes credentials, the damage is bounded by what that account could reach. If the account could reach everything, so can they.
Ransomware encrypts what the account can write to. The blast radius of an infection is not decided during the attack. It was decided months earlier, by the permissions.
Accidents get expensive. Files get deleted, moved, or emailed to the wrong recipient far more often than they get stolen. Fewer people with access means fewer chances for that.
Auditors and insurers now ask. Cyber insurance applications and client security questionnaires increasingly ask who has access to sensitive data and how that is reviewed. “Everyone, and we do not review it” is an answer with consequences.
Getting it back under control
You do not need to rebuild everything. A practical sequence:
Find out what the current state actually is. A report of who can reach what, produced from the systems rather than from memory, is usually enough to make the next decisions obvious.
Start with the sensitive material. Payroll, HR files, client records, financial systems. If a folder would be a problem in the wrong hands, it gets reviewed first.
Grant by role, not by person. When access is attached to a job rather than an individual, a role change removes the old permissions automatically instead of adding to them.
Make removal part of leaving and moving. Most businesses have a solid process for granting access and nothing at all for taking it away.
Review on a schedule. Twice a year, department heads confirm who should still have what. It takes an hour and it prevents the next five years of creep.
The point is not to lock people out
Least privilege has a reputation for making work harder. Done properly it is invisible: people keep what they use and lose what they forgot they had. The difference only shows up on the day something goes wrong, when the damage stops at one department instead of spreading across the business.
If you want to know what your current access looks like, that report is part of every security review we run — get in touch and we will show you.