A security rule that people, programs, and devices should have only the minimum access needed to do their job, and no more.
Least privilege limits the damage that mistakes, malware, or compromised accounts can cause. If a user's account is hijacked but it can only read one shared folder, the attacker's reach is small. If the same account had administrator rights everywhere, the impact could be severe.
In practice, least privilege means giving staff standard accounts for everyday work and separate administrator accounts only when necessary, granting temporary access for specific tasks, and regularly reviewing who has access to what. For example, a part-time bookkeeper might be able to view and record transactions in accounting software but not change bank details or add users. The principle applies equally to applications and AI agents, which should receive narrowly scoped API permissions. It is a core part of zero trust security.
The process of verifying that a user, device, or system is who or what it claims to be.
Identity and Access ManagementThe policies and tools, known as IAM, that control who can access which systems and data, and what they are allowed to do.
Supply Chain AttackA cyberattack that compromises a trusted supplier, software vendor, or component in order to reach that supplier's customers.
Zero TrustA security model built on the principle never trust, always verify, requiring every user and device to be authenticated and authorized continuously.
A step-by-step access review for shared drives, SaaS apps and admin rights, so every person and app has only the access they actually need.
Why attackers go after admin accounts first, what privileged access management does and the practical steps any business can take to control admin access.
What the 18 CIS Controls are, how the 3 implementation groups work and which IG1 safeguards a small team should tackle first.