When we started offering a plain security review to small firms, we expected the problems to be about clever attacks - phishing that had slipped through, some breach nobody had noticed. Mostly we found something duller and more fixable. The two things that showed up across nearly the whole set were leftover access and untested backups.

Every business we checked had at least one leaver who still had live access to something. A former bookkeeper with the accounts login. A contractor whose email account was never switched off. A shared inbox that three people who had all moved on could still reach. Nobody had done anything wrong on purpose; offboarding is just the task that never makes it onto anyone's list because the person has already gone.

The backup finding was starker. Most of these firms had a backup of some kind, and were reassured by that. Almost none had ever restored from it. That gap matters, because a backup you have never restored is a promise, not a safety net. Files get missed, permissions break, the one folder that mattered turns out not to have been included. You find that out on the worst possible day, or you find it out on a quiet Tuesday when you test.

The reason both patterns are so common is that they are invisible until something goes wrong. A live leaver account costs nothing and does nothing right up until it is used. An untested backup sits there looking like insurance. Neither trips an alarm, so neither gets attention until an incident forces it.

The good news in the numbers is that both are cheap to fix and do not need any new software. A short offboarding checklist and one genuine test restore a quarter would have closed the biggest gap we saw in almost every firm. This is the sort of finding that should be reassuring rather than frightening: the common failures are ordinary, and the fixes are ordinary too.