https://www.sikich.com

IT Horror Stories: When Everyone’s an Admin!

Dustin Miller

Nov 18 2025

3 min read

In this IT Horror Story, we look at a small publishing company that believed they were too small to be a target. Their thinking was, “Nobody’s going to hack us. We’re just a small company.”

That false sense of security turned into a nightmare. Every single user had domain admin rights, unlimited access to critical systems, sensitive data, and company resources. It only took one mistake, one click on a malicious link, for attackers to exploit this wide-open door. The result was compromised systems, costly downtime, and months of recovery.

This horror story proves a chilling truth for your business: being small doesn’t make you safe. Cybercriminals actively target small and mid-size businesses (SMBs) precisely because they assume they won’t be attacked.

The Horror of Over-Privilege

When “everyone’s an admin,” the risks compound quickly.

No Barriers for Attackers
If one user’s account is compromised, attackers immediately gain full access. Studies show that 74% of breaches involve privilege misuse or compromised credentials.
Accidental and Irreversible Mistakes
With unrestricted permissions, even good employees can accidentally delete, overwrite, or expose sensitive systems.
A Hacker’s Dream Target
Small businesses are three times more likely to be targeted by cybercriminals than larger enterprises. This is because they often leave the door wide open.

Sikich’s Solution: Principle of Least Privilege

At Sikich, we help businesses shut the door on this nightmare with proven security and governance strategies:

Role-Based Access Controls (RBAC): Users get only the permissions they need—no more, no less.
Multi-Factor Authentication (MFA): Even if credentials are stolen, accounts remain secure.
Continuous Monitoring: Proactive alerts catch suspicious privilege escalation before it spirals.
Security Culture: Educating employees that being “small” doesn’t mean being safe.

By implementing least-privilege access and strong security practices, we make sure no single user, or hacker, has the keys to your kingdom.

Don’t Let “We’re Too Small” Be Your Undoing

Size doesn’t protect you from cyberattacks. It makes you a prime target. If your employees have more access than they need, your business is already at risk.

Stop Settling for Bad IT, Make the Switch Now

Find and fix your access blind sports.

Contact Sikich today for a free security consultation. We’ll assess your access controls, identify risky over-privileged accounts, and help you build a security-first culture that protects your business.

Claim Your Free Blind Spot Assessment

This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.

About the Author

Dustin Miller

Dustin Miller is a principal, who supports the managed services practice in the role of virtual chief information officer (vCIO). Dustin helps business owners and executives understand their current IT assets, create a vision and multi-year roadmap for IT that integrates with business objectives, and align specific technology initiatives within the annual budgeting process. He provides ongoing collaboration and serves as an executive-level technology team member that understands and can speak to both technology and business topics.