Every growing business goes through a phase where the IT setup that felt perfectly adequate a year ago starts to show cracks. It's not that the setup was bad — it was appropriate for where you were. The problem is that scaling a business without scaling your IT infrastructure creates compounding risk. The gaps that are merely inconvenient at 10 employees become genuine vulnerabilities at 25, and by 40 they're full-blown liabilities.

Here are the signs we see most often, and why each one is more serious than it looks.

Shared Admin Passwords

If your team has a shared "IT password" or a shared admin account that multiple people log into, you have no meaningful access controls. When something goes wrong — and something will — you can't answer the question "who did what?" You can't revoke access for a single person without changing the shared credentials and notifying everyone else. And if that shared password has been passed around long enough, you genuinely don't know who has it.

The risk: a disgruntled former employee, a compromised device, or a phishing attack that captures those credentials gives an attacker unrestricted access to your systems with no easy way to know what they've done.

No Centralized User Management

At five employees, it's manageable to set up each person's accounts individually and track everything in a spreadsheet. At 20 employees, that approach creates a sprawl you can't control. Accounts in Microsoft 365 that aren't reflected in your internal systems. Local admin accounts on workstations that nobody remembers creating. Software subscriptions where the login is tied to someone's personal email.

Active Directory (on-premises) or Microsoft Entra ID (cloud) centralizes identity management: one place to create accounts, assign permissions, enforce policies, and — critically — disable access when someone leaves. Without it, offboarding a departing employee is a scavenger hunt across every system they might have touched. Some of those systems won't get updated for weeks.

Backups That Have Never Been Restored

"We have backups" is one of the most dangerous things to believe without verification. A backup job that completes successfully every night is not the same as a working backup. Backup jobs fail silently. Backup targets fill up and stop accepting new data. Backup software versions become incompatible with the data they're supposed to restore.

The test that matters is restoration: can you take a backup set and actually restore a working system from it? If you can't answer that question with a date — "we last successfully restored from backup on X date" — then you're relying on a system you've never validated.

Personal Email Accounts for Business Communication

When employees use their personal Gmail or Hotmail accounts for any business communication, you've lost control of that data permanently. You can't archive it, you can't retrieve it when that person leaves, you can't include it in a legal hold if you're ever involved in litigation, and it's not subject to any security policies you've put in place.

This is also a Law 25 compliance issue for Quebec businesses. If personal information about your clients is in someone's personal Gmail account, it's outside your control and almost certainly outside your documented personal information inventory.

No Patch Management

Operating systems and applications receive security patches continuously. A business without a patch management process — something that tracks what's running in the environment, what patches are available, and applies them systematically — is running an environment where critical security vulnerabilities may sit unpatched for months.

The Veeam vulnerability exploited in ransomware campaigns in 2024, the Exchange ProxyLogon vulnerabilities from 2021, the ongoing stream of Windows and Chrome patches — these are real exploits against real vulnerabilities that could have been closed with routine patching. The gap between "patch available" and "patch applied" is where most compromises happen.

Everyone Is IT Support

When the most technically comfortable person in the office becomes the de facto IT department, that person stops doing whatever their actual job is when something breaks. Which happens at the worst times, in the middle of the work that matters. It also means that IT decisions get made based on whatever seems to work, rather than on documented standards.

More importantly: that person is probably not a security specialist. They can reset passwords and restart servers. They're not monitoring your environment for threats, reviewing firewall logs, or thinking about what happens when they leave.

Personal Devices with No Policy

Bring-your-own-device isn't inherently a problem — plenty of well-run organizations support it. The problem is BYOD without a mobile device management (MDM) policy: employees accessing corporate email and files from personal devices that have no encryption requirement, no remote wipe capability, no compliance check before access is granted.

When that employee's phone is lost or stolen — or when they leave and don't return the device — there is no mechanism to revoke access to corporate data that's already on it.

No Incident Response Plan

Ask yourself: if your file server was encrypted by ransomware at 9am tomorrow, who would you call? What would the first three steps be? Who has the authority to decide whether to pay a ransom or attempt recovery? Who notifies clients if their data was exposed?

If the answer is "we'd figure it out," that's not a plan. Incident response under stress, without a documented procedure, without pre-established contacts (cyber insurer, legal counsel, IT provider), takes two to three times longer than it should and consistently makes decisions that look poor in hindsight.

What to Do When You Recognize Yourself Here

The warning signs above rarely appear one at a time. They accumulate gradually, and each one individually seems manageable. The problem is that they compound each other: no centralized user management makes offboarding harder, which means former employee accounts stay active longer, which means your attack surface stays larger than it should be.

The right starting point is a structured assessment — not a vague conversation about "where are you today," but a documented inventory of your infrastructure, accounts, software, and backup status. That gives you a baseline to prioritize from, rather than trying to fix everything simultaneously or, worse, continuing to defer until something forces your hand.

We see what happens when businesses wait for the forcing event. It's an expensive way to learn the lesson.

Signs Your Business Has Outgrown Its IT Setup