The Big Story: who still has the keys?
Quick exercise. Write down every person who could log into something belonging to your business right now. Not who should. Who could.
Most small businesses find three categories they'd forgotten about.
The person who left. Their email got shut off, and that felt like shutting off access. It wasn't. The client portal where they had their own account, the shared login they still remember, the app they connected to the company Google account two years ago — none of that turns off when email does.
The shared password. The one three or four people use for the same account. It has lived in a text message or a chat thread at some point. Nobody can tell you who used it last week, because the logs show one user, and that user is "everyone."
The app nobody remembers approving. Someone clicked "Sign in with Google" on a tool during a free trial. That tool still holds a standing key to your files. It doesn't expire. It keeps working until a human revokes it, and in most small businesses no human ever has.
None of this is exotic. It's the ordinary way small businesses get hurt: not someone breaking in, but someone who was handed a key never having it taken back.
What to do this week. All three are free:
List everyone who has left in the last two years. For each, ask what they could still log into besides email.
List every account more than one person signs into. Check whether the platform offers individual logins — most do, and most cost nothing. Meta Business Manager gives every person their own account for free, which surprises a lot of agencies.
In your Google or Microsoft admin console, open the list of connected apps and revoke anything you don't recognize.
We'd Tell You If You Needed Us
For that list, you don't. It's an afternoon and a notepad.
Where it becomes worth paying someone: when you can't reconstruct who has access, when the answer to "who else knows that password" is a shrug, or when a client starts asking you to prove how you protect their accounts. That's a different job than a checklist.
But the checklist comes first, and it's free.
See you in two weeks.
— Kfir ObsidianRidge.io
Forwarded this? Subscribe here — practical security for small businesses, every other Tuesday.