Skip to content
Cyber Unboxed
Insider Threats

Least Privilege: Why Nobody Should Have More Access Than They Need

The principle of least privilege limits damage from any mistake, theft or compromise by giving every account only the access it needs.

2 min readBeginner Aug 26, 2026

Explain Like I'm Not a Hacker

A warehouse worker's pass should open the loading dock, not the vault down the hall.

The 30-second explanation

Least privilege is a simple idea with an outsized payoff: a cleaner doesn't need the keys to the safe. Give an account only what its job actually requires, and if it's ever stolen or misused, the damage stops at whatever that one account could reach.

How it works

  1. 1

    1. Define roles

    What does this specific job actually require, day to day?

  2. 2

    2. Grant minimum

    Start small, and add access only once it's been justified.

  3. 3

    3. Time-limit

    Elevated or admin-level access expires automatically.

  4. 4

    4. Review

    Access nobody's used in months gets removed.

Access tends to pile up over time: a project here, a temporary fix there, a role that changed eighteen months ago. Left unreviewed, people end up holding far more access than they actually use, day to day. Attackers count on exactly this, because a single, perfectly ordinary stolen account can end up reaching a surprising amount. Least privilege pushes the other way. Start small, grant only what's justified, put a time limit on anything powerful, and review it regularly. As a side effect, it also makes unusual behaviour much easier to spot, since there's far less normal activity for an anomaly to hide inside.

Real-world example

An attacker steals an employee's login. Because that employee could only ever reach their own team's files, the attacker can't touch finance systems or admin consoles, and what could have been a serious breach stays small and contained.

How to spot it

  • Everyone's an admin

    Broad rights handed out for convenience, rather than because anyone needs them.

  • Old access that was never removed

    Permissions left over from a role someone moved out of a long time ago.

  • Shared administrator accounts

    A login several people use, so there's no way to tell who actually did what.

  • Service accounts with sweeping rights

    Automation accounts that can reach far more than the task they run actually needs.

What to do

  1. 1Review who holds admin rights, and remove any that aren't clearly, currently needed.
  2. 2Use separate accounts for administration and everyday work, and require MFA on the admin one.
  3. 3Schedule access reviews on a fixed cadence, and actually act on what they turn up.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading