Over the course of our checks a clear top three keeps surfacing, and it is remarkably consistent across trades. It is not exotic malware or clever intrusions. It is leavers who still have working accounts, backups nobody has ever tried to restore, and logins shared between people who should each have their own. The same three, whether we are looking at a builder, a solicitor or a care provider.

Live accounts for people who have left are the one we find most often. Someone moves on, the handover happens, but the email, the file share or the accounts login is never switched off. Months later it is still valid, still reachable from anywhere, and still trusted by every system it touches. It is the quietest risk on the list because nothing looks wrong until it is used.

Untested backups come next, and they are the cruellest, because everyone believes they are covered. A backup exists, a green tick appears, and no one has ever asked it to actually give the data back. When we test one, a meaningful share cannot restore cleanly - the job was silently failing, or it was backing up the wrong folder. A backup you have never restored is a hope, not a plan.

Shared logins round out the pattern, and they undo everything else. Once several people sign in as the same user, you can no longer say who did what, you cannot remove one person's access without disrupting all of them, and your records lose the attribution that regulators increasingly expect. It is the failure that makes the other two harder to fix.

We would rather report this plainly than dress it up, because the reassuring bit is how ordinary the fixes are. None of the top three needs new software or a big budget. They need a leaver checklist, one honest restore test, and a login per person. Boring, cheap, and the three things that would have prevented most of what we see.