An admin account is the key that opens everything: customer data, invoices, staff permissions, and sometimes the company bank portal. In a small Kuwaiti company it is usually shared by two or three people, reviewed by nobody, and protected by a password someone set in 2019. None of the fixes below need a budget or a security team.
Before changing anything, write it down: who holds admin rights, on which system, and why. You will usually find ex-employees still active and one shared login used by four people.
Length beats symbols. Four random words are easier to remember and harder to guess than eight characters with a capital letter and a number. The admin password must not be reused anywhere else, since most breaches start with a leak on an unrelated site.
Use a password manager. A spreadsheet on the desktop or notes on a phone is not storage, it is a problem postponed.
Two-factor authentication is the cheapest protection available. Turn it on for the company mailbox first, because it is the recovery route for every other account, then the control panel, then any cloud service. An authenticator app or hardware key beats SMS, but SMS beats nothing.
Not everyone who needs a report needs delete rights. Sales staff should see orders, not edit system settings. Review permissions twice a year and remove what is unused, because most over-permissioning is historical rather than intentional. A monthly reconciliation task is a classic case: it needs a report, not a full admin role with billing and user management attached.
Enable login logging and check it monthly, not during an incident. Then write one page answering this: if the admin account is compromised today, who do we call first and what do we shut off, in what order? Include the internet provider, the hosting company, and the payment provider contacts.
Sending a password over WhatsApp, leaving an admin session open on a shared laptop, and forgetting to revoke access when someone resigns. Those three cover most incidents in small companies.
If nobody in-house owns this, an outside review of the basics is usually enough. Q8DM has worked in software development, business systems, and training in Kuwait since 1998.
Start with the account list, because it takes about an hour. More practical guides are at q8dm.com.