“We’ve never had a security incident.”

That is something we often hear when discussing cybersecurity with potential clients.

The computers work, the data is available, nobody has demanded a ransom, and there has never been a situation where the entire office, clinic, hotel or other business location suddenly lost access to its systems. From that perspective, the conclusion is understandable: so far, we have never had a security incident. The problem is that a security incident does not have to look like that. Someone can gain access to a user account, business email or remote access without disrupting systems and without triggering an obvious warning. The computer can continue working, employees can continue using their applications, and the compromised access can remain active.

Sometimes the question is therefore not only whether you have had an incident. The question is whether you would have recognised it if you had.

An incident does not have to stop the business

Ransomware is easy to recognise when it encrypts data and disrupts operations. It is much less obvious when someone gains access to a business mailbox and simply observes it. That access can reveal who employees communicate with, what documents they receive, which services they use, when invoices arrive, who approves particular requests and what normal business communication looks like. Nothing has to stop working.

The same applies to user accounts and remote access. If the credentials still work, an attacker does not necessarily have an incentive to do something immediately that would reveal their presence. The access can be used later or as a starting point for reaching other parts of the environment. From the company’s perspective, everything still looks the same: the systems work.

Who still has access?

There is also a simpler scenario that does not have to begin with a sophisticated attack. An external IT provider receives access for maintenance. A business software supplier gets remote access during an installation. An employee is given an account for an application they need to use. An additional administrative account is created temporarily because something needs to be resolved quickly.

Months or years pass, people change, suppliers change, the project ends, but the access remains. With accounts like these, the important question is not only who should have access, but who actually has it today. Has the former employee’s account been disabled? Does an old supplier still have remote access? Is there a service account that nobody is quite sure about anymore? Do several people share the same access? Is there an account that has not been used for months but is still active? Until someone checks, the answer often comes down to assumption.

“We would notice if someone logged in”

Maybe. But it depends on what is being monitored. If someone accesses a business email account from an unusual country or a new device, is there an alert that someone will actually see? Does anyone review failed sign-in attempts, newly added multifactor authentication methods or changes to mailbox rules?

If remote access to the network exists, is it clear who uses it and when? If a user account suddenly accesses a system it does not normally use, is there any way to notice? A smaller company does not need a security operations centre or people analysing logs all day. But it should know which access points matter most and whether there is at least basic control over them. Without that, “we’ve never had an incident” can easily mean only “we’ve never seen anything obvious enough to call an incident”.

The same problem looks different in every industry

In an accounting firm, a compromised mailbox can provide access to client communication, invoices, documentation and payment-related information. In a hotel, a single user account or reception computer may have access to reservations, business applications and other systems required for daily operations.

In a clinic or medical practice, a small number of accounts may provide access to patient data, appointments, reports and other sensitive information. In a private school or training centre, the same problem may affect communication with employees, students or parents, as well as administrative documentation.

A travel agency may process bookings, traveller information, invoices and communication with partners through only a handful of mailboxes and business applications. In a law firm, a single compromised account can provide access to documents and communication connected to a large number of clients and cases.

For financial services providers, IT service providers or other organisations where individual accounts have broader privileges, the consequences of one compromised access point can be even greater.

The number of employees therefore says very little about how important a particular account is. What matters is what that account can access and what can be done from it.

The goal is not to look for an incident where there isn’t one

A security review should not begin with the assumption that an organisation has already been compromised. But the opposite is not useful either: assuming that no compromise has occurred simply because there have been no visible consequences.

It is far more useful to check a few concrete things: which accounts and remote access methods exist, who uses them, whether old access has been removed, how important accounts are protected and whether there is anything unusual that has so far gone unnoticed. If everything is in order, that is a good result. If not, it is much better to find out while the systems are still working normally.

AresISEC performs security assessments and technical reviews aimed at establishing the actual state of an organisation’s IT environment, access and security controls, and identifying risks that are worth addressing. Not noticing a security incident is not the same as never having one. And access that has once been compromised will not necessarily disappear on its own. If you want to check whether there are access paths or security weaknesses in your environment that have gone unnoticed, contact us.

Sources:
NCSC – Small organisations guide to cyber security: Spotting cyber attacks
NCSC – Small organisations guide to cyber security: Secure your important online accounts
CISA – Require Multifactor Authentication
ENISA – SMEs Cybersecurity