10/21/2026
The first thing I check when we start with a new client isn't the firewall.
It's who has admin access.
Almost every time, I find some combination of:
- Former employees with accounts that are still active
- Everyday users who were made admins "just to install something"
- Shared admin logins nobody can trace back to a person
Each one is an open door. Cleaning them up costs nothing and closes a real share of the risk on day one.
Try it this week: pull a list of every admin account in your email and Microsoft 365 and ask, "Does this person still need this?"
Have a security leadership question? Drop it in the comments and it might be the next one I answer here.