What is least privilege?
Least privilege means users, systems, and administrators should only have the access needed to do their work, and nothing more.
Simple example
A staff member who only needs to send invoices should not also have administrator access to the whole accounting system.
Why it matters
If an account is compromised, least privilege can reduce how much damage the attacker can do.
Common warning signs
- The activity is unexpected or unusual for the business context.
- The request or system behaviour creates pressure to act quickly.
- Normal approval, verification, or security processes are bypassed.
- There are signs of unauthorised access, data exposure, or system change.
- Staff are unsure whether the request, message, or system behaviour is legitimate.
Cyber Doc view
This term should be understood in business context, not only as a technical issue. Good protection usually combines clear processes, appropriate technical controls, staff awareness, and a calm response plan.
What to do
Proactive steps
- Review user permissions regularly.
- Avoid using administrator accounts for daily work.
- Remove access when staff change roles or leave.
- Use role-based access where possible.
- Limit access to sensitive systems and data.
Reactive steps
- Review what the affected account could access.
- Remove unnecessary permissions immediately.
- Check whether sensitive systems or data were reached.
- Reset credentials and sessions for affected accounts.
- Improve access reviews after the incident.
Related terms
- Privileged account
- Access control
- Account takeover