If Your IT Person Left Tomorrow, Could You Get Back In?
Key person risk is a security problem, and most businesses discover theirs on the worst possible day
Executive Summary
In most small businesses, one person holds the keys. Sometimes an employee, sometimes an outside provider. They know which systems matter, where the accounts live, and what the passwords are. The arrangement is efficient and usually reflects trust that was earned. It is also a single point of failure that no security tool you own can see. When it ends, through a resignation, an illness, or a dispute over an invoice, businesses discover that critical accounts are registered in someone else's name, recovery codes go to a mailbox they cannot open, and the domain carrying the company's email is controlled by a login nobody else has. This is not a question of loyalty. It is a question of whether the business owns its own access.
Nobody Decided This
It happens the same way almost everywhere. In the early days one capable person gets things working. They set up email under their own account, register the domain on their own card, and become the administrator because there was only one. The company grows, the systems multiply, and nobody revisits the arrangement, because on any given day nothing is wrong.
That is what makes this risk so easy to miss. It produces no alerts and no complaints. It simply sits there, working perfectly, until the one condition it depends on changes.
What They Actually Hold
Ask most owners what their IT person controls and you will hear about laptops and the network. The list that matters is shorter and heavier:
- The domain registrar and DNS records. Whoever controls these controls your email and your website.
- The global administrator account for Microsoft 365 or Google Workspace, including the ability to reset everyone else's access.
- The backup system and the credentials required to restore, which matter on exactly one day and matter completely.
- Vendor and licensing portals, where renewals, support cases, and billing live.
- The phone number or authenticator app that receives the multifactor codes for everything above.
That last item quietly outranks the rest. Whoever owns the recovery method owns the account, no matter whose name is on the invoice.
Ownership Is the Control
The fix is not a tool and it is not a policy binder. It is a change in whose name things are in.
Every account that runs the business should be registered to the business: a company email address you control, billed to a company payment method, with recovery routed to a mailbox or shared alias that more than one trusted person can reach. Individuals then work through their own named administrator accounts underneath that, which can be revoked without disturbing ownership. Keep one break glass administrator account whose credentials sit under the owner's control and are not used day to day.
Once the business owns the top of the chain, a departure becomes an inconvenience instead of an emergency. Everything below it can be handed over in an afternoon.
The Half Nobody Mentions
A single unsupervised administrator is not only a continuity risk. It is an accountability gap.
When one person holds every privilege and no independent record exists of what was done, you cannot tell an honest mistake from misuse, and you cannot answer an insurer, a client questionnaire, or an investigator afterward. Independent logging and monitoring is not a statement of distrust. It protects a good administrator at least as much as it protects the company, because it produces evidence that the work was sound. Capable technical people tend to welcome that once it is framed honestly.
A Test You Can Run This Quarter
You do not need an assessment. You need five answers.
- Ask for a written list of every account with administrative access, and whose name each one is registered under.
- Sign in to your domain registrar yourself, using credentials the company holds, and confirm the billing contact is the company.
- Have someone other than the usual person perform a restore from backup, on a real file, while you watch the clock.
- Confirm where password vault and account recovery messages are delivered, and whether the business can reach that mailbox.
- Write the privileged departure sequence in advance: what gets revoked, what gets rotated, what gets re-enrolled, and in what order.
If any step depends on a favor from one person, you have your answer.
The Takeaway
Most businesses will never deal with a disgruntled administrator. Nearly all of them will face an ordinary resignation, a sudden illness, or a provider relationship that ends less warmly than it began.
The goal is not to take authority away from the person who has earned it. It is to make sure the business keeps its own. Access that lives in one head, one inbox, or one personal credit card is not a security posture. It is a bet on continuity that nobody made on purpose.
How Simulint Helps with BlueSphere
BlueSphere Shield Velocity includes vCISO advisory, which is where this work belongs: establishing who owns each privileged account, deciding what a departure sequence looks like, and holding someone accountable for it other than the person holding the keys. BlueSphere Fabric Elevate adds vCIO advisory and the documented view of your environment that makes a handover an afternoon rather than an archaeology project.
BlueSphere Shield provides around the clock monitoring, so the watch over your systems does not depend on one person being available, employed, or awake. That independence is the point. Security that rests on a single individual is not resilience. It is a habit that has not been tested yet.
Learn more about BlueSphere: https://lnkd.in/eE9HTaw8
