Open Doors for Cyber Risks in the Company

The most important thing first

The biggest vulnerabilities in companies are often not technical, but organizational and human. Untidy offboarding processes and too trusting handling of unknown requests can give attackers direct access to systems. Those who consistently secure accounts, permissions, and behavior in the workplace significantly reduce the risk.

At Neo One we repeatedly see the same pattern in audits and penetration tests: not the spectacular attack, but everyday negligence opens the door. Exactly there, the biggest gaps for attackers arise, and exactly there effective protection starts.

Why are cyber risks often human-made?

Many security gaps have no technical cause. According to Manuel Caprioli of Neo One, employees often react too credulously to social engineering attempts, and former employees sometimes still have active accesses. This is especially critical for management and IT responsible personnel, because a small lapse can quickly become a security incident.

What does the missing offboarding process show?

In the first practical example, Neo One found a user account during a security analysis that was no longer on the current list of authorized employees. The person had not been with the company for about six months, yet could still log into the system regularly. Neither Neo One nor the client knew what activities this person had actually performed in the network.

This is where the reputational damage for a company becomes tangible: if accesses are not closed cleanly after departure, it remains unclear whether data was manipulated, confidential project data accessed, or accesses were shared. In the worst case, infiltration of malware or ransomware would also have been possible.

Deactivate all accounts and accesses upon departure immediately.
Standardize and document permissions.
Secure the offboarding process with clear responsibilities.

Practical rule for offboarding

A defined offboarding process is not formalism but a security measure. If permissions are not consistently removed, the company remains vulnerable even after departure.

How does a manipulated cable function as an attack?

In the second example Neo One checked the behavior of employees in dealing with social engineering during a penetration test. A reception person plugged a manipulated OM.G cable into the PC without hesitation, even though it looked like a regular USB-C cable. From a nearby location, the team could then access the corporate network without further restrictions.

What matters is not the cable’s technology alone, but the everyday reaction. The cable masqueraded as an input device, could automatically execute commands and bypass security measures that only block file-based threats. A single careless connection could have been enough to install malware, activate a keylogger, or create a backdoor.

Which measures strengthen the security strategy?

The lesson from both examples is clear: IT security measures must be considered organizationally and humanly. Neo One supports SMEs and organizations with consulting, implementation, operation, training, and cyber security from a single source, so security incidents do not occur in the first place due to routine errors.

Educate employees about social engineering.
Never connect unknown devices to company devices.
Regularly review accesses by role and function.
Train, document, and anchor security rules in everyday life.

Frequently asked questions

How do companies notice that their security strategy is too lax?

A typical warning sign is unclear responsibilities for accounts, access rights, and offboarding. If no one can safely say which permissions are still active, a risk for cyber threats arises quickly. Repeated uncertainty with unusual requests also shows that awareness in daily life is missing.

Is good technology alone enough to prevent security incidents?

No, the examples show the opposite. Even good protection systems help only to a limited extent if employees react credulously or processes like offboarding do not work cleanly. A resilient IT needs technology, processes, and trained people.

What should happen immediately when an employee leaves?

All accounts, accesses, and permissions must be deactivated immediately. Additionally, it should be checked whether VPN accesses, admin rights, or other special permissions are still open. The more standardized the process, the smaller the risk of later security problems.

Why are social engineering attacks so dangerous?

Because they target trust and routine rather than technical weaknesses. An attacker can pose as a technician, place a device, or make a seemingly harmless request. If the staff does not react with suspicion, it can quickly lead to direct access to systems.

Open doors for attackers rarely result from one big mistake, but from several small gaps in daily operations. Those who take cyber risks seriously combine clear processes with awareness and regularly review the security strategy.

Neo One shows with these practical examples how important consistent IT resilience is if companies want to protect their data, systems, and accesses effectively. That is where sustainable protection against cyber risks begins.

Sicherheitslücken schliessen statt Angriffe ermöglichen

Neo One AG, Bassersdorf

Beratung anfragen