Skip to content
Cyber Unboxed
Insider Threats

Least Privilege: Why Nobody Should Have More Access Than They Need

The simplest way to limit the damage of any mistake, theft or compromise is to give every account only the access it truly needs.

2 min readBeginner Aug 26, 2026

Explain Like I'm Not a Hacker

Give people the keys to the rooms they work in, not a master key to the whole building.

The 30-second explanation

A cleaner does not need the keys to the safe. If someone's account is stolen, or they make a mistake, the damage is limited to what that account could reach.

How it works

  1. 1

    1. Define roles

    What does each job actually need?

  2. 2

    2. Grant minimum

    Start small; add only what is justified.

  3. 3

    3. Time-limit

    Elevated access expires.

  4. 4

    4. Review

    Remove access that is no longer used.

Accounts tend to collect access over time: a new project, a temporary fix, a change of role. Without review, people end up with far more access than they use. Attackers love this, because a single stolen ordinary account may be able to reach a lot. Least privilege reverses the trend: start with little, grant what is needed, time-limit powerful access, and review regularly. It also makes unusual behaviour easier to spot.

Real-world example

An attacker steals an employee's login. Because the employee could only reach their team's files, the attacker cannot open finance systems or admin consoles, and the incident stays small.

How to spot it

  • Everyone is an admin

    Broad rights given for convenience.

  • Old access never removed

    Permissions from roles someone left long ago.

  • Shared admin accounts

    No way to tell who did what.

  • Service accounts with wide rights

    Automation accounts that can do far more than they need.

What to do

  1. 1Review who has admin rights and remove any that are not clearly needed.
  2. 2Use separate accounts for administration and everyday work, and require MFA for admin.
  3. 3Schedule regular access reviews and act on the results.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading