# What does least privilege mean in practice?

It means that every person, account and system gets only the access it needs for its job, for as long as it needs it, and nothing more. In practice, for a small company: staff are not local administrators on their PCs; administrators use a separate admin account for admin work and an ordinary one for e-mail and browsing; file shares are open to the teams that use them, not to everyone; suppliers get access to the systems they support, switched on when needed; service accounts get only the rights their application needs; and access is reviewed when people change roles or leave. The payoff is that one stolen password or infected laptop reaches far less. It also cuts noise: unusual access stands out more when normal access is narrow. NetSenX watches the network side of this: it flags new sessions between hosts that do not match their normal as lateral movement, on every plan, which often reveals access nobody meant to allow.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/what-is-least-privilege-in-practice

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Do service accounts and API tokens need monitoring too?](https://netsenx.com/en/faq/do-service-accounts-and-api-tokens-need-monitoring)
- [Are shared admin accounts a problem, and what should we do instead?](https://netsenx.com/en/faq/how-to-handle-shared-admin-accounts)
- [Are password managers safe for a company to use?](https://netsenx.com/en/faq/are-password-managers-safe-for-a-company)
- [What makes a good company password policy?](https://netsenx.com/en/faq/what-makes-a-good-company-password-policy)
- [What is single sign-on, and does it improve security?](https://netsenx.com/en/faq/what-is-single-sign-on-and-does-it-improve-security)