Privileged Access Management Without an IT Team

Privileged access management is sold as enterprise software with vaults and session recording. Underneath the product category sit four decisions a ten-person business can make in an afternoon, and those decisions determine how bad your worst day gets. The timing matters now because a new category of user has started asking for credentials, and it does not have a manager.

What counts as privileged

Anything that can change rather than only read. Administrator accounts in your email tenant, your accounting package, your CRM and your website. Billing contacts. Whoever can add a user or reset a password. Whoever can publish, delete or issue a refund.

Most small businesses can list those in ten minutes and have never done it. The list is short, and it is nearly always longer than the owner expects, because permissions are granted during setup and revisited never.

The four controls

Control	What it prevents
Separate admin from daily use	One phished email login becoming full control
Name every account's owner	Orphaned access nobody removes
Two people on the irreversible things	A single compromised account moving money
Review twice a year	Permissions accumulating for a decade

Separating admin from daily use is the one with the largest effect and the most friction. If the account you read email on is also the account that administers your Microsoft or Google tenant, then one successful phish is the whole business. A second account used only for administration, with its own strong authentication, contains that.

Naming an owner sounds bureaucratic until you find the integration set up by a developer who left in 2023, still holding write access to your CRM. Every account gets a person responsible for whether it should still exist.

Two people on irreversible actions means payments above a threshold, changes to banking details, deleting records, and issuing refunds beyond a set amount. This is the control that survives a convincing message, which is why it beats teaching people to spot one, as we argued in what security awareness training cannot fix.

Reviewing twice a year is what stops the other three from decaying. Diarise it, attach the list, and expect to remove something every time.

Service accounts are where it goes wrong

A user account belongs to a person. A service account belongs to an integration, and has no one sitting behind it noticing anything odd. It rarely expires, its password rarely changes, and its permissions were set during a configuration session that ended years ago with someone choosing the option that made the error message stop.

These are the accounts most likely to be missing from any list, and the ones an attacker most wants. They also tend to hold exactly the broad access you would never grant a person.

Find them by looking at what is connected rather than who is employed. Your email tenant, accounting package and CRM all have a page listing connected apps and API access. That page is usually a surprise.

The hour-long access review

1. List the systems that hold money, customer data, or the ability to publish. Usually eight to fifteen for a small business, including the ones a single department uses.

2. For each, write down who has administrator rights. Open the admin page and read it rather than recalling it. Recall is consistently wrong here.

3. Ask three questions per name. Do they still work here. Do they still need this. Is this their daily-use account.

4. Do the same for connected apps and integrations. The non-human list, which is usually longer and less justifiable.

5. Remove what fails, and write the date on the sheet. The date is what makes the next review take fifteen minutes instead of an hour.

Agents are a new kind of privileged user

Software that logs into your systems on your behalf needs an account, and the temptation is to hand it an existing one because that works immediately. Doing so makes every later question unanswerable: who did this, was it the agent or the person, when did it start.

The same four controls apply with almost no translation. Its own named service account. Scope limited to the systems the task needs. An approval gate on anything irreversible. Actions logged somewhere the agent cannot write to. That is the framework in three boxes for an AI agent, and it is the same reasoning as listing what is permitted rather than what is forbidden.

The credential-handling side of this is moving quickly, and some of the designs are genuinely good, which we look at in your AI agent can now log in as you.

Why this is worth an afternoon

Nothing here prevents an incident. Phishing still works, unpatched software still gets exploited, suppliers still get compromised. What access design changes is the blast radius, and that is the variable with the widest range of outcomes.

It also happens to be on every insurance application and client security questionnaire you will see this year, as covered in what cyber insurance covers and wants. One afternoon buys a better premium and a smaller worst case, which is an unusually good trade for work nobody enjoys.

Frequently Asked Questions

What is privileged access management?

Controlling who holds the accounts that can change things rather than just read them: administrators, owners, billing contacts, anyone who can add a user, move money, delete records or alter configuration. Enterprise products automate this with vaults and session recording. For a small business it is mostly four decisions written down and reviewed twice a year, which needs no product at all.

Why does privileged access matter more than other security controls?

Because it decides how bad an incident gets rather than whether one happens. In the PaperCut campaign GreyNoise reported this month, an attacker compromised servers at 395 organisations but reached domain administrator in only 12. The difference between those groups was not who got breached. It was how far a single compromised machine could reach once the attacker was inside.

What is the difference between a service account and a user account?

A user account belongs to a person who logs in. A service account belongs to a system, integration or automation, has no human owner sitting at a keyboard, and usually never expires or changes its password. Service accounts accumulate quietly, often hold broad permissions granted during a setup that finished years ago, and are the accounts most likely to be missing from any list your business keeps.

How do I run an access review?

List every system holding customer data, money or the ability to publish. For each one, write down who has administrator rights and why. Then ask three questions per name: do they still work here, do they still need it, and is this their daily-use account. An hour covers most small businesses, and the usual result is two or three names nobody can justify plus one former contractor.

What changes when AI agents have credentials?

Agents need accounts, and an account you cannot distinguish from a person’s in the audit log makes an investigation impossible later. Give each agent its own named service account, scope it to the systems the task needs, keep an approval gate on anything irreversible, and log actions somewhere the agent cannot write to. These are the same four controls you would apply to a contractor, applied to software that behaves like one.