Every budget meeting at a small or mid-sized organization eventually produces a spreadsheet. It lists security product categories: endpoint detection, email security, a SIEM, vulnerability scanning, backup, maybe a dark web monitoring line somebody added after a conference. Next to each category sits a vendor and a renewal date. The plan is to work down the list as the budget allows.

I understand the instinct. After endpoint deployments approaching 5,000 organizations and protecting over two million devices, I've seen hundreds of these spreadsheets. The problem is that a checklist measures what you own, not what you've closed off. You can own twelve tools, have five deployed, three configured, and one that anybody on your resource constrained IT team still knows how to run, and the checklist will tell you you're covered the whole time.

And the checklist was built for an attacker who shows up as malware. IBM's X-Force Threat Intelligence Index tracked the abuse of valid account credentials as a top way into organizations for two years running, and in 2025 it still accounted for nearly a third of the incidents IBM responded to. Attackers aren't breaking in. They're logging in. They buy or phish a credential, sign in the way an employee would, and use whatever access your environment hands them. That's an access story from the first minute to the last. So organize your security program around access, which takes exactly three questions.

Who gets in?

This is the front door: credentials and destinations. Are passwords unique and managed, backed by MFA, or is the office manager's password also her streaming password? What happens when a user clicks a link to a phishing site that didn't exist yesterday morning, too new for any blocklist to have caught? Everything about identity and the paths into your environment lives under this question, including the quiet ones: the shared login the front desk has used for years, and the account belonging to someone who left in March that still works in October. If you can't answer this question, nothing downstream matters much, because this is the door attackers use.

What can they do once they're in?

This is the question most organizations skip, and it decides whether a bad day costs you one machine or every machine. If your users run as local administrators, the answer is "everything." A stolen credential inherits every right the account carries: install the payload, disable the defenses, read every share the account can reach. The same logic applies to network reach. A VPN that drops a user onto the flat network gives a stolen login to the whole building.

The fix is the same in both places. Nobody and nothing carries standing admin rights. Users run as standard accounts, just-in-time elevation grants rights per task and takes them back when the task ends, and network access is scoped to the application someone actually needs. You're deciding the blast radius before the breach instead of discovering it afterward.

Can you prove it?

As far as your auditor, your cyber insurance carrier, and your board are concerned, a control you can't provide evidence for doesn't exist. Every control that matters should write its own record: who touched what, when they had the access, how long it lasted, and who signed off. If producing that answer takes a week of pulling event logs off individual endpoints, you don't really have the answer. You have a scavenger hunt. I've sat in renewal meetings where the carrier asked exactly how elevated access is granted and tracked, and watched "we have a policy" land like a shrug. The organizations that sail through those meetings aren't the ones with the longest tool list. They're the ones that can pull the report.

Buying by question instead of category

Here's how the three questions change procurement. Before any renewal or new purchase, ask which question the tool answers and whether something you already own answers it better. If a product doesn't clearly answer one of the three, it waits, no matter how good the demo was.

The questions also expose what the checklist hides. Plenty of organizations pass a twelve-line checklist and still have no good answer to the second question, because privileged access never made it onto the original list. The list came from what vendors sell, and vendors sell categories.

A 200-person company with limited IT resources can't outspend the threat. It can know its own environment better than any attacker does, and the three questions are how. Attackers are already asking these three questions about your environment. They ask them every time they test a stolen password. Answer them first.

David Bellini is co-founder and CEO of CyberFOX. He previously served as Chief Operating Officer and President of International Sales and Operations at ConnectWise, which he co-founded with his brother Arnie.