Should Employees Use Personal Devices for Work?
Summary: Allow personal devices only for approved work, through approved apps, and when the device meets your security requirements. Use company-owned devices for administration, sensitive
Summary: Allow personal devices only for approved work, through approved apps, and when the device meets your security requirements. Use company-owned devices for administration, sensitive
Administrator access often starts with one request. An employee needs to install a printer, update a specialist program, or change a setting on their computer.
Giving them administrator access gets the job done. The problem is that the access usually stays after the request has been completed.
From then on, the employee can approve other software installations and make changes that would normally require help from IT. If they install the wrong program or someone takes control of their account, those permissions can also be used to change the computer.
For everyday work, employees should use standard accounts. Administrator access should be kept for tasks that require it.
Cyber insurance applications include a question that catches a lot of small business owners off guard: “Do you maintain immutable, air-gapped, or offline backups of your critical business data?”
Carriers added that question to renewal forms because ransomware operators worked out that the fastest way to force a payout is to wipe the backups first and encrypt everything else after. CISA, the AFP, and the Australian Signals Directorate have all documented this pattern as one of the most common moves in current ransomware playbooks. A business whose backup copies can be deleted using the same admin credentials an attacker just stole has no recovery path other than paying the ransom.
This post covers what immutable backup means, three common backup setups that do not qualify, the questions to send your IT provider before you sign the form, and what to do if your honest answer is no.
Someone leaves the company on a Friday. By Monday, their email account is disabled, and their laptop is back in the pile.
What nobody checks is their login to the project management tool they signed up for in Q3, the cloud storage folder they shared with a contractor, or the CRM access they still have from two roles ago.
Three months later, those sessions are still active.
This is how zombie accounts form. nNot through negligence, but through an offboarding process built around corporate IT assets that no longer reflects how people actually use software.
The average company now runs more than 100 SaaS applications. Most offboarding checklists were written when there were three.
What a Zombie Account Actually Is
A zombie account is an active login that belongs to someone who no longer works for you. The name is informal. The risk is not.
What makes zombie accounts particularly dangerous is that they are valid credentials.
There is nothing to detect. The access was granted intentionally, and the system has no reason to question it. If a former employee walks back in through that door, or if their credentials are compromised after they leave, the access is there waiting.
Industry research finds that 50% of organisations have discovered former employees still accessing SaaS applications months after their departure date.
For most of those organisations, the discovery was accidental rather than the result of a deliberate audit.
The most time-consuming ticket in your queue is rarely a hardware failure. It’s the PC infection that started when a user installed something they shouldn’t have been able to. Or it’s the broken configuration left behind after someone changed a setting IT can’t trace.
Local administrator rights (the ability to install software, modify system settings, and override security controls) are given to end users far more often than the risk warrants.
The usual reason is efficiency.
The practical result is the opposite. Machines that drift from baseline, infections that spread before they are caught, and remediation requests nobody planned for. Revoking local admin rights directly removes the root cause of most of those requests.
The most dangerous thing in a server room is often the phrase, “Don’t touch that.”
It’s usually said with a half-joke and a grimace. It refers to the old box that “still works”, runs something important, and has survived so many fixes and workarounds that nobody feels confident changing it anymore.
That’s legacy debt.
Not just “old tech”, but old tech that’s become a dependency. It’s the kind that quietly accumulates risk until it turns into downtime, security exposure, or an emergency upgrade at the worst possible time.
A legacy debt audit is the fast way to bring that risk back into the light.
A fake recruiter message is one of the cleanest social engineering tricks around because it doesn’t look like a trick.
That’s why LinkedIn recruitment scams work so well inside real businesses.
They don’t arrive as malware. They arrive as a normal conversation that nudges someone toward one small action: click this link, open this file, “verify” this detail, move the chat to a different app.
A few simple checks, a couple of hard-stop rules, and an easy way to report suspicious outreach can shut these scams down without slowing anyone down.
If you want to uncover unsanctioned cloud apps, don’t begin with a policy. Start with your browser history.
The cloud environment most businesses actually use rarely matches the one shown on the IT diagram. It’s built through countless small shortcuts: a “just this once” file share, a free tool that solves one problem faster, a plug-in installed to meet a deadline, or an AI feature quietly enabled inside an app you already pay for.
In the moment, none of it feels like a problem. It feels efficient. Helpful.
Until it isn’t. Then you realise business data is scattered across tools you didn’t formally approve, accounts you can’t easily offboard, and sharing settings that don’t reflect the actual risk.
It usually starts small. Someone uses an AI tool to refine a difficult email. Someone enables an AI add-on inside a SaaS app because it promises to save an hour a week. Someone pastes a paragraph into a chatbot to “make it sound better.”
Then it becomes routine.
And once it’s routine, it stops being a simple tool decision and becomes a data governance issue: what’s being shared, where it’s going, and whether you could prove what happened if something goes wrong.
That’s the core of shadow AI security.
The goal isn’t to block AI entirely. It’s to prevent sensitive data from being exposed in the process.
Think about your office building. You probably have a locked front door, security staff, and maybe even biometric checks. But once someone is inside, can they wander into the supply closet, the file room, or the CFO’s office? In a traditional network, digital access works the same way, a single login often grants broad access to everything. The Zero-Trust security model challenges this approach, treating trust itself as a vulnerability.
For years, Zero Trust seemed too complex or expensive for smaller teams. But the landscape has changed. With cloud tools and remote work, the old network perimeter no longer exists. Your data is everywhere, and attackers know it.
Today, Zero Trust is a practical, scalable defense, essential for any organization, not just large corporations. It’s about verifying every access attempt, no matter where it comes from. It’s less about building taller walls and more about placing checkpoints at every door inside your digital building.
Looking for something else? You can navigate through our menu or use this search bar: