Ask who has administrator access to your website, your CRM, and your billing system. In most small organizations the honest answer is: more people than anyone can name, including at least one former employee and a marketing agency from two contracts ago.
Least privilege is the principle that every account gets the minimum access its job requires, and nothing more. The content editor can edit content but not install software. The bookkeeper can see invoices but not customer passwords. The intern from last summer can see nothing, because the account was closed the day the internship ended.
This matters because most real-world incidents are not sophisticated. They are a phished password on an account that had far more power than its owner needed. When that account can only edit blog posts, the damage is a bad blog post. When it is a shared admin login, the damage is your whole system.
The fix costs almost nothing: an afternoon reviewing accounts, removing what is unused, and downgrading what is overpowered, repeated a couple of times a year. It is the highest ratio of protection to effort in all of security, which is exactly why it is the first thing we audit on any system we take over.
