The principle of least privilege limits blast radius. If a user account or API key is compromised, the attacker can do only what that identity was allowed to do.
Common gaps
- Standing admin access in production environments.
- Shared credentials stored in chat or wikis.
- Service accounts with overly broad permissions.
Good habits
- Use role-based access with time-bound elevation workflows.
- Automate access reviews and revoke stale permissions.
- Require just-in-time access for privileged tasks.
Related Articles
View all articles
On-Prem AI for Regulated Industries: Keeping LLMs Inside Your Walls
For healthcare, finance, legal, and government, sending prompts to a third-party API is often a non-starter. Here's how to run capable AI on infrastructure you control — and meet HIPAA, data-residency, and audit requirements.
Read article →
AI Agent Protocols Explained: MCP vs A2A vs ACP and the Agent Interoperability Stack
MCP and A2A are not rivals — they are complementary layers of the same stack: MCP connects an agent to tools and data, A2A connects agents to each other. Here is the whole interoperability landscape, with ACP, ANP, and AGNTCY put in their place.
Read article →
MCP Security Risks: A Practical Threat Model for Teams Connecting AI Agents to Tools
MCP isn't uniquely unsafe, but every server you connect widens your attack surface. A risk catalogue, the trust model you're actually accepting, and the governance controls MSPs and security teams should put in place.
Read article →
Claude Cowork: Anthropic's Autonomous Desktop Agent (What MSPs Need to Know)
Claude Cowork is an agentic mode in the Claude Desktop app that reads, edits, and organizes files on your computer and runs multi-step tasks on its own. Here's how it works, who can use it, and the security and governance controls IT teams should put in place first.
Read article →Explore More Security Foundations
View all termsAttack Surface
The total number of points where an unauthorized user could try to enter data into, or extract data from, an environment.
Read more →Authentication
The process of verifying the identity of a user, device, or system before granting access to resources or services.
Read more →Vulnerability
A weakness in a system, application, or process that could be exploited by a threat actor to gain unauthorized access or cause harm.
Read more →Zero Trust Architecture
A security model that assumes breach, requiring continuous verification of every user, device, and workload regardless of location.
Read more →