Least Privilege: What It Means and How to Apply It

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 12 November 2026.

In one sentence: Least privilege means every person, account and piece of software gets only the access it needs to do its job, so that when one account is stolen, the thief can do as little as possible.

What it is

The NCSC’s network security fundamentals page says the principle of least privilege means users and systems have access only to the resources needed to do their job. It is a design rule, not a product. You apply it to staff accounts, administrator accounts, software, service accounts, suppliers and firewall rules.

It matters because attackers rarely stop at the first account they steal. They look for more access. The NCSC says highly privileged accounts, such as those used for system administration, are prime targets for attackers, because administrators can change security settings, install software, delete users and access all files.

How it works

Find out who needs what. List each role (for example reception, bookkeeper, developer, IT) and the systems each needs.
Give the smallest set of permissions that does the job. Use standard accounts for daily work, and separate administrator accounts for admin tasks only.
Make high access temporary. The NCSC describes “Just in time” administration, where staff request access and receive a temporary credential, and “Just enough” administration, which it calls another way of describing least privilege. It points out that if an attacker steals a temporary credential, their window of opportunity is significantly reduced.
Review and remove. People change roles and suppliers finish projects. Access should be removed when the job is completed.
Log administrator actions so misuse stands out.

It does not stop a compromise by itself. It limits what a compromise can reach. It works best with multi-factor authentication (see multi-factor-authentication).

Who it affects and how badly

Every business, because every business has accounts. The risk grows when one person holds many roles.

Sole trader to 10 staff (trades, estate agents, small accountancy or legal practices): often everyone is an administrator, and one phished account reaches everything. Worst case: email, files and banking details all exposed at once.
10 to 50 and 50 to 250 staff (manufacturing, care providers, schools, recruitment, retail): shared admin accounts and old supplier access build up. Worst case: ransomware that spreads using one over-privileged account, with days of downtime.
Regulated and 250 plus (fintech, insurance, healthcare, councils, telecoms): you must show who can access personal data. Worst case: a regulator asks why one user could read all records, and you cannot answer.
MSPs and SaaS start-ups: broad access to many customers makes a single account worth a lot to an attacker.

Real examples

Remote management tools. CISA’s guide to securing remote access software recommends least-privilege-use configurations and “reduced privilege” RMM tools for common uses such as read-only monitoring, and advises MSPs not to reuse admin credentials across customers. Source: CISA guide. See remote-monitoring-and-management-tool-abuse.
Official guidance example (not an incident). Its privileged access management guidance gives a small-company example, where administrators request temporary credentials and note the reason, using a shared approvers mailbox, so no one can act alone and workflow barely changes. Source: NCSC.

The UK angle

The NCSC’s *Choosing a managed service provider* guide for SMEs says to use least privilege, giving your MSP only the permissions needed to do the job, and to enforce 2-step verification. It adds that users should only have access to what they need to do their job, that access should be removed when the job is completed, and that administrative accounts should only go to people who really need them. It also lists “users with unnecessary administrative rights” as something regular audits should identify.

An illustration for a small business

*This is an illustration, not a real case.* A ten-person accountancy practice gives every member of staff administrator rights “to avoid IT calls”. A bookkeeper clicks a fake sign-in page and their password is stolen. With admin rights, the attacker reads all client folders and deletes the backups. The practice loses days of work and has to assess a possible personal data breach. If staff had used standard accounts, with client folders shared by role and backups reachable only from a separate admin account, the same stolen password would have exposed one mailbox and a few files. The fix costs time, not money: create standard accounts, remove admin rights, and keep one separate admin account protected by MFA.

What we check on a test

A Wolfcore penetration tester looks at:

Whether a normal user account can reach files, systems or settings beyond its role.
How many accounts are administrators, and whether admins use their admin account for email and browsing.
Whether service accounts and supplier accounts have broader rights than they need.
Whether shared or default admin passwords exist, and whether they are reused across systems.
What an attacker could reach starting from one low-privilege account.

How to detect it

List all administrator accounts in Microsoft 365 (admin centre, Roles) or Google Workspace (Admin console, Account, Admin roles). Count them and name an owner for each.
Review local administrator membership on laptops and servers.
Look for accounts nobody can explain: ex-staff, old suppliers, test accounts.
Check sign-in logs for admin accounts used for email or from unusual places.
Ask your IT provider for a report of accounts with elevated rights. The NCSC says scheduled audits can identify users with unnecessary administrative rights.

How to fix or prevent it

Give staff standard accounts and remove day-to-day admin rights.
Keep separate admin accounts, used only for admin tasks, with multi-factor authentication.
Define roles and give access by role, not by person.
Make high-level access temporary where you can (just in time), as the NCSC describes.
Remove access on the day someone leaves or a supplier finishes.
Audit accounts on a schedule, and check administrator accounts first, since the NCSC says they should be secured in proportion to the risk they pose.
Use allow-lists for network rules, with a final deny-all rule, as the NCSC recommends.
Never reuse admin passwords across systems or customers (see secret-rotation).

Browse the Credentials and exposure category.

FAQ

Is least privilege the same as zero trust? No. The NCSC describes zero trust as removing inherent trust in the network and verifying each access request. Least privilege is a separate principle that you can apply inside that approach.

Does it slow staff down? It can if overdone. The NCSC says approval processes must be accessible and timely enough for administrators to do their job.

Where should I start? With administrator accounts. Count them, remove the ones that are not needed, and protect the rest with MFA.

How Wolfcore helps

Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy. To see what a stolen account could reach in your systems, see our penetration testing at our penetration testing service.

What is least privilege and how do you apply it in a small business?