Every network has a small set of accounts that can do anything: create users, change security settings, read everyone’s files, delete the backups. Attackers know it, which is why nearly every serious intrusion follows the same arc — get in anywhere, then hunt for those accounts. Privileged access management is the unglamorous discipline of making that hunt fail. At enterprise scale it involves expensive platforms; at small-business scale, it’s mostly five habits. Here they are.
Why admin accounts are the whole game
A regular user’s compromised account is a bad day: their email, their files. A compromised admin account is the company — and specifically, it’s how a ransomware incident goes from one infected laptop to every server encrypted and the backups deleted first. The attacker’s playbook after landing on any machine is to escalate: harvest whatever credentials that machine has seen, and climb. Every unnecessary admin right in your environment is a rung you’ve installed on their ladder.
Habit 1: Separate the person from the privilege
The classic small-business mistake: the IT person — or the owner — does everything as an administrator. Email, browsing, the works. Which means every phishing email they open, every malicious ad their browser renders, executes with the keys to the kingdom. The fix costs nothing: two accounts per privileged person. A normal account for the day job, and an admin account used only for the ten minutes a week that actually need it. The admin account gets no mailbox — an admin account that can’t receive email can’t receive phishing.
Habit 2: Take local admin away from daily users
On most unmanaged networks, everyday employees are administrators of their own computers — usually because it was convenient during setup and nobody circled back. That single default is what lets a bad click install malware silently, disable protections, and hand the attacker a running start. Removing it is the highest-friction, highest-value move on this list: some software will grumble, and there’s a transition month of “I need IT to install this.” That month buys you an environment where most malware simply fails to land. Pair it with a sane process for legitimate installs so the friction stays small — least privilege only sticks when the sanctioned path is easy.
Habit 3: Count your admins, then subtract
Ask your IT provider or team a simple question: how many accounts have admin rights, and why each one? The honest first answer usually includes surprises — the vendor account from a 2021 project, the former employee’s “temporary” elevation, the service account nobody remembers, the software installer that granted itself more than it needed. Review the list twice a year. The right number of standing admins in a small business is small — often two or three humans plus documented service accounts — and every name on the list should have a reason you can say out loud.
Habit 4: Make the remaining admin accounts hard targets
The few that survive the subtraction get the full treatment: MFA, no exceptions, ever — insurers now ask about admin MFA by name, because stolen admin credentials are behind so many claims; long unique passwords in a proper password manager, never shared, never reused; and no shared “admin” logins — shared credentials mean you can’t revoke one person, and can’t tell who did what. Which leads to:
Habit 5: Watch what the privileged accounts do
Admin activity should be logged and occasionally reviewed — new accounts created, rights granted, security settings changed, unusual sign-in locations or hours. Not because you distrust your people, but because this is exactly what an attacker using stolen credentials looks like, and admin-account anomalies are the earliest loud signal most intrusions give. If you have monitoring with humans behind it, privileged accounts are the first thing worth pointing it at.
The right-sized version
You don’t need an enterprise PAM platform. You need: separate admin accounts with no email · daily users without local admin · a twice-yearly admin census · MFA and a password manager on what remains · eyes on privileged activity. A motivated business can land all five inside a quarter, and the result is the single best return in small-business security: the attack that lands on a regular account and stays a regular-account problem — contained, boring, and recoverable — instead of becoming the company-wide story.