The Security Gaps Most Growing Companies Miss Until It Is Too Late

Conceptual illustration of security gaps in growing companies, with a network cabinet, laptop and incomplete shield.
Eight security gaps in growing companies, explained in plain words, with a check you can run this week for each and a 16-point scorecard to rank the fixes.
admin
October 26, 2026
Table of Contents

By Sarraf Talent

 

Security gaps in growing companies tend to open in the handoffs between departments, where nobody owns them. Eight are worth checking first: accounts that outlive their users, sign-in protection that stops at email, internet-facing devices nobody updates, backups never tested, open-ended vendor access, unapproved software, unread logs and no written incident plan. Each can be checked this week.

Key Takeaways

  • In Sophos’s 2026 survey of 2,158 organizations hit by ransomware, 62% said a security gap, known or unknown, was a factor in the attack.
  • Exploited software flaws are now the most common way into a company, at 31% of breaches in Verizon’s 2026 report, and only 26% of the flaws on the federal known-exploited list were fully fixed during 2025.
  • Each gap can be checked with records the company already holds, such as HR’s list of leavers and finance’s software payments.
  • The scorecard near the end gives each gap 0 to 2 points, and a zero on any of the first three is where to start.

Why Security Gaps in Growing Companies Open Without Anyone Noticing

A security gap is the distance between the protection a company believes it has and what is in place. The safeguard may be missing, it may cover only some systems, or nobody may be checking that it still works.

In a company of 20 people, one administrator can know every laptop and every login, and hears the same day when someone leaves. At 200, that knowledge is split among HR, finance, an IT team and outside providers, and each assumes another has it covered. The federal Cybersecurity and Infrastructure Security Agency (CISA) describes the result in its guidance for small businesses: “Most organizations fall into the trap of thinking the IT team alone is responsible for security.”

Sophos’s State of Ransomware 2026 surveyed 2,158 IT and security leaders at organizations of 100 to 5,000 employees that had been hit by ransomware (software that locks a company’s files until a ransom is paid) in the previous year. Of those, 62% cited a security gap, known or unknown, as a factor in the attack, and 36.3% named a gap they had not known about.

Eight Security Gaps and How to Check Each One This Week

Each gap below matches a named goal in CISA’s Cybersecurity Performance Goals, a voluntary baseline meant to help small and medium-sized organizations start with a limited number of high-impact actions. Every entry ends with a check and the work that closing the gap involves.

1. Accounts That Outlive the People Who Used Them

When someone leaves, their logins are supposed to stop working. Often the HR record is closed while the accounts stay live, because nobody told IT or because a shared mailbox still depends on them.

In a case described in a 2024 CISA advisory, an attacker entered a state government network through the account of a former employee with administrator rights. The account had not been disabled when the employee left, and its password had likely leaked in a separate data breach.

How to check: ask HR for everyone who left in the past 12 months, contractors included, and ask IT which of them still has an active account anywhere.

To close it: have HR start one offboarding checklist that IT signs off, and review idle accounts on a schedule. CISA’s goals recommend disabling accounts left inactive for a set period and give 30 days as an example.

2. Multi-Factor Authentication That Stops at Email

Multi-factor authentication (MFA) asks for a second proof of identity, such as a code from a phone app, on top of the password. A company can have it on email while a remote-access portal, a finance system or the administrator accounts still open with a password alone.

That was the opening in the 2024 attack on Change Healthcare, a UnitedHealth Group business that handles health care claims and payments. In written testimony to a House subcommittee, UnitedHealth’s chief executive said criminals used compromised credentials to enter a remote-access portal that did not have MFA, and that ransomware was deployed nine days later. Among the 503 respondents in the Sophos survey whose attack began with compromised credentials, 97% had MFA enabled in some capacity, which Sophos says may mean it was not deployed on every relevant system.

How to check: ask IT for a list of every system reachable from the internet, with a yes or no for MFA beside each, plus a list of administrator accounts.

To close it: enforce MFA in each system’s settings so that nobody can skip enrollment. CISA’s phrase is to mandate it “using technical controls, not faith.”

3. Internet-Facing Devices Nobody Patches

A firewall (the device that filters traffic into the office network), the VPN (virtual private network) gateway that remote staff connect through and any server reachable from the internet all run software that needs updates, called patches, whenever a flaw is found. They are easy to leave alone, because an update means a planned outage.

The Verizon 2026 Data Breach Investigations Report found that exploiting a software flaw is now the most common way into an organization, at 31% of breaches, while credential abuse (signing in with stolen passwords), the previous leader, fell to 13%. It also found that organizations fully fixed only 26% of the flaws listed in CISA’s Known Exploited Vulnerabilities catalog during 2025, and that the median fix took 43 days.

How to check: ask for every device and service the company exposes to the internet, the software version each runs and the date of its last update, then compare the list with the CISA catalog, which is public.

To close it: name an owner for each device and set a regular update schedule. Known exploited vulnerabilities and urgent vendor advisories need prompt, risk-based action rather than waiting for the monthly window. Retire or isolate systems that can no longer be supported.

4. Backups That Have Never Been Restored

A backup report that says “completed” only proves that files were copied. Whether a working system can be rebuilt from them, and how long that takes, stays unknown until someone tries. Ransomware appeared in 48% of the breaches in Verizon’s 2026 report, which adds that small organizations are disproportionately affected, and CISA notes that many victims “either had no backups or had incomplete/damaged backups.”

How to check: pick one system the business cannot run without, such as accounting, and have IT restore it from backup onto a spare machine while someone times it. Ask too whether one copy is kept offline, out of reach of an attacker already inside the network.

To close it: put a restore test on the calendar with a named owner. The CISA goals set the minimum at once a year.

5. Vendors and Contractors With Standing Access

Access is handed out as a company adds outside help: a managed service provider (an outside firm that runs IT day to day), a payroll processor, the developer who built the website. Those logins tend to stay open after the work ends. In Verizon’s 2026 data, a third party was involved in 48% of all breaches and in 55% of breaches at small and medium-sized businesses.

How to check: ask for a list of every outside company and contractor with a login or remote connection, what each can reach, and when that access was last reviewed.

To close it: put an end date on every vendor account and name an internal owner for each relationship. The CISA goals add that contracts should detail “how and when” a managed service provider notifies the customer of an incident.

6. Software and AI Tools That IT Never Approved

Shadow IT is software that staff start using without IT knowing: a file-sharing account on a team credit card, a project tool on a free plan, an AI assistant in the browser. Company data then sits where nobody backs it up or watches it. Verizon’s 2026 report found that 45% of employees in its dataset are regular users of AI on their work devices, authorized or not, up from 15% a year earlier, and that 67% of users reach AI services through non-corporate accounts, meaning logins the company does not manage.

How to check: ask finance for 12 months of software and subscription charges from invoices and company cards, and set them beside IT’s list of approved applications.

To close it: offer an approval route for new software that is quick enough for people to use, and publish the list of approved tools, AI services included.

7. Logs That Nobody Reads

A log is the record a system keeps of who signed in and what they did. Logs are how a company notices an intruder and, afterward, how it works out what the intruder touched. Sophos’s Active Adversary Report 2026, which analyzed 661 incident response and managed detection cases, found that missing logs due to data retention issues doubled over the previous year, driven largely by firewalls whose default was seven days or, in some cases, 24 hours. It also found that 88% of ransomware was deployed outside business hours.

How to check: ask how many days of logs are kept for the firewall, the email system and the main business applications, and who would see an alert at 2 a.m. on a Sunday.

To close it: send logs to one central place, keep them for a period someone has chosen deliberately, and make a person or service responsible for alerts outside office hours.

8. No Written Plan for the First Hour

The first hour of an incident goes to decisions, such as who can order a server shut down and who calls the bank. Without a written plan, those decisions fall to whoever happens to be reachable, and the delay has a price. Business email compromise, in which a criminal takes over or imitates a trusted email account to redirect a payment, accounted for $3.05 billion in reported losses in 2025, according to the FBI’s Internet Crime Complaint Center. Its Recovery Asset Team froze 58% of the $1.16 billion at stake in the 3,900 incidents it took on that year, and the report tells victims of a fraudulent transfer that “time is of the essence.”

How to check: ask three managers, separately, whom they would call first if the file server were encrypted tonight. Three different answers mean there is no plan.

To close it: write one page, kept on paper, that follows the small business guide from the National Institute of Standards and Technology (NIST): who owns the plan, whom to call (business leader, technical contact, state police, legal counsel, bank, insurer) and what must be reported to whom. The CISA goals call for drilling the plan at least once a year.

Score Your Company on the Eight Gaps

Put each question to the people in the last column. Score 2 for a yes that someone can back with evidence, 1 for “partly” or “I think so,” and 0 for a no or for a question nobody can answer.

Gap Question to Ask Usual Owners
1. Old accounts Can IT show that nobody who left in the past year still has a login? HR and IT
2. Partial MFA Is MFA enforced on every internet-reachable system and administrator account? IT
3. Unpatched devices Is there a dated update record for every internet-facing device? IT and any outside IT provider
4. Untested backups Was a critical system restored from backup in a timed test this year? IT and operations
5. Vendor access Is there a reviewed list of every outside firm that can log in? IT, procurement and legal
6. Unapproved software Does IT’s approved list match what finance pays for? Finance and IT
7. Unread logs Are logs kept for a chosen period, with alerts watched after hours? IT
8. No incident plan Is there a one-page plan with names and numbers, drilled this year? Chief executive and IT

A total of 13 to 16 suggests that most answers are supported, and the exercise is worth repeating after major changes and at least annually. It does not establish that the company is secure. From 7 to 12, several gaps are open and each zero needs a name and a date beside it. At 6 or below, the work needs an executive sponsor. These bands are a working rule of thumb, and no standard defines them.

Whatever the total, deal first with a zero on gap 1, 2 or 3, the routes an attacker uses to get in. Gaps 4 and 8 come next, because they shape how long an incident keeps the business down.

The scorecard rests on what people tell you. A formal cybersecurity risk audit and assessment tests the same areas with technical evidence, and it is worth considering when the answers conflict or nobody can give one.

When the Data Is Regulated

Some data comes with rules of its own. Electronic health information handled by an organization covered by HIPAA, the federal health privacy law, or by a company working for one, is subject to the HIPAA Security Rule, overseen by the U.S. Department of Health and Human Services. For payment card data, the reference is PCI DSS, a standard maintained by the PCI Security Standards Council. Businesses the Federal Trade Commission (FTC) treats as financial institutions, including mortgage brokers, tax preparation firms and collection agencies, answer to the FTC Safeguards Rule, and the agency’s summary of it mentions multi-factor authentication, user activity logs and a written incident response plan. Whether a rule applies to your company, and what it requires, is a question for legal counsel or a qualified assessor.

Frequently Asked Questions

Who should own cybersecurity in a growing company?

It should be one named person with the authority to ask HR, finance and operations for evidence. CISA calls the role a Security Program Manager and says the person “doesn’t need to be a security expert or even an IT professional.” The chief executive keeps a part of the job, since CISA asks the CEO to review and approve the incident response plan.

What is a cybersecurity gap analysis?

A gap analysis compares what a company does today with a reference list of practices and records where the two differ. The NIST Cybersecurity Framework calls the two sides a Current Profile and a Target Profile. The scorecard above is a short version of the same exercise.

What is the 80/20 rule in cybersecurity?

It is an informal rule of thumb, borrowed from the Pareto principle, that a small set of basic controls prevents most incidents. The percentages are a figure of speech and should not be read as a measurement. The nearest official counterpart is CISA’s Cybersecurity Performance Goals, which aim to help smaller organizations by “prioritizing investment in a limited number of essential actions with high-impact security outcomes.”

What percentage of small businesses fail after a cyber attack?

There is no reliable figure. The claim that 60% of businesses close within six months of a cyber attack once appeared in an infographic on the National Cybersecurity Alliance’s website. In 2022 the Alliance said the statistic did not come from its research, that it could not verify the original source and that it does not recommend using it.

Start With the Question Nobody Can Answer

The most telling result on the scorecard is any question that nobody in the room could answer. Give each of those a name and a date this week, starting with gaps 1 to 3. Most of the fixes come down to a list, an owner and a schedule, so the first ones can begin this month.

If a second opinion on the results would help, security risk audits and assessments are among Sarraf Talent’s services, and you can book a discovery call to talk through what your scorecard showed.

Sources

Research and drafting were assisted by AI. The linked sources support the factual claims; any worked examples and scorecards are illustrative guidance, not Sarraf Talent client results.