Security budgets tend to go to products, because products are easy to approve. But when we review an incident at a mid-sized company, the cause is rarely something a product would have stopped. It is an account belonging to someone who left eight months ago, still active, still with administrator rights.
Know what you have
An asset inventory sounds like paperwork. It is the control everything else depends on. You cannot patch a server you have forgotten about, and forgotten servers are where trouble accumulates — the reporting box someone spun up for a project that ended, still exposed, still running an old operating system.
The controls with the best return
- Multi-factor authentication on email and remote access. Nothing else on this list comes close for value per rupee spent.
- A leaver process that actually runs. Access removal on the last working day, verified by someone other than the person leaving.
- Separate administrator accounts. Daily work should not happen in an account that can reconfigure the domain.
- Backups you have restored from. An untested backup is a hypothesis, not a control.
- Patching on a schedule, with a named owner and a defined window.
Phishing is a process problem
Training helps, but people will always click occasionally — the convincing ones are genuinely convincing. Design so that a single click is survivable: multi-factor authentication, restricted permissions, and a payment process where no individual can both create and approve a beneficiary.
The most useful metric is not how many staff clicked. It is how quickly the first person reported it. A workforce that reports quickly and without fear of blame is worth more than one that clicks slightly less often.
Then consider products
Once the basics hold, tooling adds real value — endpoint detection, log aggregation, vulnerability scanning. Bought first, they generate alerts nobody has capacity to investigate, which is worse than no alerts at all, because it creates the appearance of control.
Where to start this week
List every account with administrator rights. For each one, name the person responsible and confirm they still work here. That exercise takes an afternoon and, in our experience, surprises almost everyone who runs it.
