Cyber security risks don’t always begin with sophisticated attacks. Sometimes, the problem is much simpler. For example, an old account nobody realised was still active.
Dormant accounts, outdated permissions and weak passwords are easy to overlook as businesses grow, systems change and people move on. Yet these basic gaps can leave an organisation unnecessarily exposed.
A real-world example
On 20 October 2026, the Information Commissioner’s Office (ICO) issued reprimands to two organisations in Wales following a ransomware attack.
The attack exploited a test account which had existed for more than 12 years and was protected by the password “Password1”. Personal information relating to 3,300 people was taken, the majority of whom were children.
The incident is a stark example of how an unnecessary account can remain inactive and forgotten for years, opening the door to a serious cyber attack.
So, how confident are you that overlooked access issues are not putting your organisation at risk?
What should you do?
The answer does not have to be complicated. Start by understanding who has access to what, then check that every account and permission is still needed.
1. Review dormant accounts
Maintain a complete record of every account across your organisation. Review it regularly, disable access promptly when it is no longer needed and investigate unexpected activity before removing an account.
2. Move to passkeys
Use passkeys wherever they are supported. They provide phishing-resistant protection without relying on a password. Where passkeys are unavailable, use a password manager to generate a strong, unique password and enable two-step verification.
3. Limit administrator privileges
Apply least privilege; give people and services only the access they need. Use Just-In-Time privilege elevation, or separate administrator accounts for administrative work, protect them with strong authentication and review privileged access regularly.
4. Make access reviews routine
Make access reviews part of every role change and system change. Remove access promptly when it is no longer required and make sure non-standard accounts and recovery methods are included in each review.
5. Test and monitor continuously
Manage vulnerabilities continuously rather than relying on occasional checks. Use well-scoped penetration testing to provide independent assurance that your security controls and vulnerability-management processes work as intended.
How Runewall can help
At Runewall Security, we help organisations find vulnerabilities and understand what they mean for the business.
Our penetration testing identifies weaknesses an attacker could exploit, helping you prioritise findings and take practical steps to reduce risk.
Whether your concern is outdated systems, access controls or the wider security of your infrastructure, understanding your exposure is the first step.
Do not wait for an incident to reveal a problem that could have been found earlier.
Contact us at www.runewallsecurity.com to discuss how we can help strengthen your organisation’s security.