Lesson 03 · 3 min · 5 things to do
One account is never one account
Explain how a single login becomes access to everything.
An attacker has one ordinary employee's login. Why is that rarely where it stops?
- Yes.Access accumulates. People change roles, projects end, permissions are granted for a week and never removed — so an ordinary account is often a key to a great deal more than anybody intended.
- Not quite.Usually not, and they rarely need them — there is enough reachable from an ordinary account already.
- Not quite.One password unlocks one account. The reach comes from what that account is permitted to see.
Permissions accumulate and almost never shrink. The question is not what an account is for — it is what it can reach today.
Slide through an employee's five years and watch their access.
Year 1Year 3Year 5Systems they can reach6 systemsSystems their job needs6 systemsYear 1Access to their team's files and the systems their job needs.
Systems they can reach19 systemsSystems their job needs7 systemsYear 3Two role changes and a project. The old access came with them.
Systems they can reach34 systemsSystems their job needs8 systemsYear 5Nobody has ever removed anything. Their login now reaches most of the organisation.
Why does the gap only ever grow?
- Yes.Every grant has a person asking for it. No revocation has an advocate, and taking access away risks breaking something. So the ratchet only turns one way unless a process forces it.
- Not quite.The same pattern appears in well-run organisations, because the incentive is structural rather than about competence.
- Not quite.They usually ask for exactly what they need for the task in front of them. The accumulation comes from never removing it afterwards.
Move the control to see what changes.
Which of these limit how far one compromised account can reach?
Reviewing and removing access when someone changes role.
Separating systems so one login does not open the next.
Requiring extra approval for sensitive actions.
A stronger password policy.
More security awareness training.
Yes.The last two reduce how often an account is compromised. Neither changes what happens once one is — and this lesson is entirely about the second question.An account can reach 34 systems and its job needs 8. How many systems is an attacker handed that nobody intended?
systemsYes.Twenty-six, none of them a security failure on their own. Each was a sensible grant that outlived its reason.Why do defenders talk about assuming a breach has already happened?
- Yes.Prevention will fail some fraction of the time — you did that arithmetic last lesson. The question that remains is how much one failure is worth, and that is a design decision made long before the incident.
- Not quite.Prevention removes the great majority of attempts and is where most of the value is. It just cannot be relied on to work every time.
- Not quite.A useful working assumption rather than a fact — and the design conclusions are the same either way.
Lesson complete
Permissions accumulate and never shrink, so one account reaches far more than its job.
Next: Your suppliers are your surface →