In a small company, the most common routine is handing every employee a computer with the same level of control as the IT technician: install whatever they want, turn off antivirus if it "gets in the way", click through any warning that pops up. According to the State of Ransomware 2026 report from Sophos, based on nearly 2,200 IT leaders across 17 countries, the employee's own device was the entry point in 30% of ransomware attacks — second only to an exposed application or system (38%).
The Brazil-specific cut of the same study, published in July 2026, shows the other side of the same coin: malicious email was the most common technical root cause locally, present in 37% of attacks — the highest share among all countries in the study — ahead of exploited vulnerability (24%) and phishing, the fake email pretending to be someone trustworthy (18%). A malicious email only works if someone opens the attachment or clicks the link. And what that click can do next depends on a detail almost no small company questions: how much power that person is logged in with.
That question sounds technical, but it decides the size of the damage. On a machine where the employee is an administrator, whatever program they opened by mistake inherits that same power: it installs anything, disables protection, spreads to other computers on the network. On a machine where they are not, the same click hits a locked door.
What administrator power actually unlocks
Being an administrator on a computer isn't just "being able to install programs". It means changing any system setting, turning off antivirus, altering the network connection, reading other accounts' folders on the same machine, and erasing the record of what happened there. It is the same level of access the IT technician uses to fix the computer — handed, by default, to someone who only needs it to do their job.
Microsoft describes this difference in its documentation for User Account Control, the Windows feature that asks "do you want to allow this?" before any important change. According to that documentation, the feature's purpose is to limit "the access that malicious code has to execute with administrator privileges" — the protection assumes the person is logged in as a standard user, and only requests the extra power when it is genuinely needed.
The problem is that this protection stops working once the daily account is already an administrator account. In that case, the prompt that should be a barrier turns into an automatic click on "yes" — the same person who opened the malicious attachment also approves, without noticing, its installation.
That is why the browser toolbar that appears out of nowhere, the "PDF converter" downloaded from some random site, or the game installed on the checkout computer are not just visual clutter. Each of those programs, running on an administrator account, had license to install itself, change the browser homepage, read whatever crosses the screen, and keep running quietly after the person forgets it exists.
When the program is genuinely malicious, that same power gets used for something else: disabling antivirus before acting, copying files from the machine itself, and trying to reach other computers on the same network using the access that account already had.
Why "I can't work like this" is the wrong complaint
The common way to handle this is not to handle it: leave everyone with administrator power because removing it takes effort, triggers an error in some old program, and draws an almost immediate complaint — "I can't work like this". Faced with that, the shortest path is usually to hand the privilege back and move on.
That complaint sounds reasonable, but it starts from the wrong comparison. The choice isn't between "having administrator power" and "not being able to work". It's between two ways of getting a new program: one where the person just handles it themselves, with nobody knowing what landed on that machine; and one where they ask, someone approves it in minutes, and the program gets installed safely — by the same person who would have done it anyway.
The cost of the first path doesn't show up right away. It shows up weeks later, when nobody remembers why that computer got slower, why the antivirus is off, or why the browser opens an ad page before any website. Every machine turns into a different version of the others, and the technician who needs to fix one of them starts from scratch, with no idea what was installed, when, or by whom.
Removing administrator power without putting anything in its place really does block some tasks — and that is exactly why the complaint exists. The mistake isn't listening to it; it's answering it by handing back the same old power instead of building a fast way to request what's missing.
What has to be in place
A well-run environment separates two things most small companies treat as one: using the computer and administering the computer.
A standard account for daily use, with no administrator privilege. Every employee logs in with an account that cannot install software or change system settings. Only whoever handles IT has a separate account, used exclusively for that.
A simple channel to request an install. When someone genuinely needs a new program, there is a fast way to ask for it — a ticket, a message — with a reply in minutes or hours, not a "someone will get to it".
A list of what already comes approved. The programs a person's role actually requires — a document reader, a browser, a spreadsheet editor — are available out of the box, so the request process doesn't become a bottleneck for every common task.
A record of who asked for what. Every install gets documented. If a problematic program turns up months later, it is possible to know exactly when it arrived and at whose request.
Antivirus and security updates the person themselves cannot turn off. Even on a standard account, nobody should be able to disable protection by clicking "dismiss" on a warning.
Access matched to each person's role, reviewed periodically. A salesperson doesn't need the same power as a network technician — and that distribution gets reviewed from time to time, not decided once and forgotten.
This is how Skills IT works: a standard account for daily use, a ticket channel to request installs, and managed antivirus that no one can turn off on their own.
What the company gains by taking that power away from everyone
The most direct gain is less downtime. A machine with no loose administrator power is harder to infect — and easier to rebuild when something does get through, because the technician knows exactly what was installed on it.
Picture a store's checkout computer, with a game installed out of curiosity by some employee. If that machine crashes or gets infected in the middle of a sale, the damage isn't just the repair: it's the line stalling, the customer waiting, the improvised manual checkout while someone sorts it out. On an account with no administrator privilege, the game simply would not have been able to install itself — and the conversation, if it needed to happen at all, would have happened earlier, at the request stage, not later, at the repair stage.
The employee's own device was the entry point in 30% of ransomware attacks.
There is also a less visible gain: predictability. When every machine follows the same list of approved programs, the technician handling a ticket doesn't need to investigate from scratch what makes that particular computer different from the others. That is staff time spent solving the problem, instead of staff time spent figuring out what changed.
And there is a direct financial gain: fewer machines reimaged from zero, fewer employees sitting idle waiting for their computer to come back, and less rework from a technician repeating, on every visit, a cleanup that a simple control would have prevented.
Questions to bring to the next meeting
Before deciding whether this is worth changing, a few questions help measure the current size of the risk:
- How many people, today, can install any program on any computer in the company? If the answer is "everyone", that number is also the size of the entry point.
- Is there a fast, clear way to request a new program? If the answer is "message someone and wait", that delay is why people handle it themselves.
- Who decides what makes it onto the approved-programs list, and how often is that list reviewed? A list that never changes turns, over time, into another version of the same mess.
- Can the antivirus be turned off by whoever is using the computer? If the answer is yes, the control only lasts until the first annoying warning.
- If someone on the team opened a malicious attachment right now, what would that computer let the program do on its own? That question sums up all the others.
