Three questions. Thirty seconds. That’s all it takes to find out whether your business has one of the most common security blind spots out there.
September is National Insider Threat Awareness Month, and while the phrase “insider threat” tends to conjure images of a disgruntled employee stealing files, the reality is usually far more ordinary. Most insider risk doesn’t come from bad intentions. It comes from access that nobody is keeping track of: old accounts that were never shut off, vendors who were given the keys and never asked to hand them back, and permissions that quietly grew over time.
So before we get into the details, try this quick self-check. Answer honestly, and don’t look anything up.
The 30-Second Access Check
Question 1: Could you name everyone who has access to your business’s systems right now, off the top of your head?
Question 2: Does anyone who has left your company in the last year still have a working login?
Question 3: Do any of your vendors or contractors have more access than their actual job requires?
If you hesitated on even one of these, you’re in good company. This is the gap we find most often when we start working with a new organization, and it almost never happens because someone made a careless mistake. It happens because nobody owns the job of checking.
Let’s walk through why each question matters and what a good answer looks like.
Question 1: Can You Name Everyone Who Has Access Right Now?
Most businesses can list their employees. Far fewer can list everyone who can actually log in to their email platform, accounting software, file storage, CRM, website, payment tools, and cloud services.
That difference matters. Access tends to spread in small, reasonable-seeming steps. Someone needs to cover for a coworker on vacation, so they get added to a shared inbox. A new tool gets rolled out and everyone gets admin rights because it’s faster. A part-time helper gets a login “just for this project.” Each decision makes sense in the moment, but nobody goes back to undo them.
A good answer to this question isn’t a perfect memory. It’s a current, written list of who has access to what, and a person responsible for keeping it up to date. If that list doesn’t exist, that’s the first thing to fix.
Question 2: Do Former Employees Still Have Working Logins?
When someone leaves, the office keys usually get returned and the laptop gets collected. Digital access is easier to miss, especially for tools that were set up outside the main company account, like a social media login, a vendor portal, a shared password, or a personal device that still syncs company email.
Leftover accounts are a problem even when the former employee has no intention of using them. An unused login is an unwatched door. If that person’s password is ever exposed in an unrelated breach, an attacker can walk right in, and nobody inside the company is paying attention to that account.
A good answer here is a consistent offboarding checklist that covers every system, not just the obvious ones, and is completed on the employee’s last day. It also helps to reset any shared passwords that person knew.
Question 3: Do Vendors Have More Access Than Their Job Requires?
Outside partners are essential. IT providers, bookkeepers, marketing agencies, software vendors, and consultants all need some level of access to do their work. The trouble starts when that access is broader or longer-lasting than it needs to be.
It’s common to see a vendor with full administrator rights when they only need to manage one application, or a contractor whose project ended months ago but whose account is still active. Every one of those extra permissions widens the path an attacker could use if that vendor is ever compromised.
The principle to aim for is called least privilege: everyone gets the access they need to do their job, and nothing more. For vendors specifically, it’s worth reviewing what each one can reach, whether that access is still needed, and what security expectations you’ve set with them. That’s the heart of third-party risk management.
Why This Gap Is So Common: Nobody Owns the Job
Here’s the part that surprises most business owners: access gaps rarely come from negligence. They come from a responsibility that falls between the cracks.
HR handles hiring and departures but doesn’t manage software accounts. The IT provider manages systems but may not be told when someone leaves or changes roles. Department leads grant access to their own tools but don’t see the full picture. Leadership assumes someone else has it covered. Everyone is doing their part, and still nobody is doing the review.
That’s why insider risk is as much a governance issue as a technical one. The fix starts with a simple decision: name an owner for access reviews and give them a regular schedule. For many small and mid-sized businesses, that ownership naturally sits with a security leader, which is exactly the role a virtual CISO (vCISO) is designed to fill.
How to Close the Gap: A Simple Access Review Routine
You don’t need expensive software to get started. A basic access review can be done with a spreadsheet and a few focused hours. Here’s a practical routine:
1. Build the list. Write down every system your business relies on, then list every person and vendor who can log in to each one, including their permission level.
2. Remove what shouldn’t be there. Shut off accounts for former employees, finished projects, and anyone you can’t identify.
3. Trim what’s too broad. Reduce administrator rights to the people who truly need them, and narrow vendor access to the specific tools they support.
4. Lock in the process. Create onboarding and offboarding checklists so access is granted and removed the same way every time.
5. Repeat on a schedule. Review access at least quarterly, and any time someone changes roles or a vendor relationship ends.
If you want a clearer view of where else your defenses might have gaps, a vulnerability assessment can surface issues you won’t catch on a spreadsheet, and an incident response plan makes sure your team knows what to do if an account is ever misused.
Frequently Asked Questions About Insider Threats and Access Reviews
What is an insider threat?
An insider threat is a security risk that comes from people who have legitimate access to an organization’s systems, such as employees, former employees, contractors, or vendors. It includes intentional misuse, but most insider risk comes from accidents, forgotten accounts, and access that is broader than it needs to be.
When is National Insider Threat Awareness Month?
National Insider Threat Awareness Month takes place every September. It is a yearly reminder for organizations to review how they manage access and reduce risk from inside the business.
What is a user access review?
A user access review is a regular check of who can log in to each of your business systems and what they are allowed to do. The goal is to remove access that is no longer needed and reduce permissions that are broader than someone’s role requires.
How often should a small business review user access?
Most small and mid-sized businesses should review user access at least once a quarter, plus any time an employee leaves, changes roles, or a vendor relationship ends.
What is the principle of least privilege?
The principle of least privilege means every person and vendor gets only the access they need to do their job, and nothing more. It limits the damage if any single account is misused or compromised.
Who should be responsible for access reviews?
Access reviews should have one clearly named owner, usually a security leader who coordinates with HR, IT, and department heads. Businesses without an in-house security leader often assign this responsibility to a virtual CISO.
Let’s Talk It Through
If you couldn’t answer all three questions with confidence, that’s not a failure. It’s useful information, and it’s one of the easiest security gaps to close once someone takes ownership of it.
This Insider Threat Awareness Month, consider setting aside an hour to run through the checklist above. And if you’d like a second set of eyes, or want help figuring out who should own access reviews going forward, reach out to the Cyberstone team. We’re always happy to talk it through.