When you watch a horror movie, you don’t get scared by the things you can see. You get scared when something pops out behind a door, jumps out from a shadow, or makes a noise when you least expect it.
Networks work the same way. The cyber breaches that hurt businesses most rarely come through a dramatic front-door attack. They come through the accounts nobody turned off, the backups nobody tested, and the devices nobody can explain. Quiet stuff. Boring stuff. Stuff that's been there for months…waiting.
We put together a checklist of the 13 most common “Frights” that most organizations forget about, and in this post we'll walk through six of them in detail.
Every organization has them: logins that function in the background after a person leaves the company. It could be a marketing coordinator who left in March or the contractor whose project ended last year. Their accounts are still active, still resetting passwords to whatever the default is, and still showing up in your system as trusted users.
Attackers love zombie accounts because they come with history. A stolen account that's been dormant for eight months looks exactly like an employee who's been on leave. It usually doesn’t raise any alarms or questions.
Here’s how to check for them: Pull a list of active accounts and compare it against your current roster. If you find accounts belonging to people who've left, disable them today.
Somewhere on your network is a machine that nobody can explain. It might be a former employee's laptop that never got wiped (or returned). A vendor's device that plugged in during an install two years ago and never left. A printer with more access than your CFO.
Ghost devices matter because every unknown device is an endpoint you're not patching, monitoring, and accounting for. You can't defend what you can't name.
Here’s how to check for them: Ask whoever manages your network for a device inventory, then walk it. Anything that gets an “I’m not sure” or an “I don’t know” instead of an explanation goes on the investigation list.
This fright is as old as passwords themselves, and it's still doing damage because credential reuse means one breach anywhere becomes a breach everywhere. An employee's password from a fitness site that got hacked in 2021 is the same password they use for your email. Credential-stuffing tools know this, and they try those old lists against business systems around the clock.
Here’s how to check for them: Ask these two questions: Is there a password manager in place, and is MFA turned on for email and remote access? If either answer is no, you've found your haunting.
Unfortunately, we run into this scenario often. A business with real, functioning, well-intentioned backups gets hit with ransomware, and the restore fails. The job had been silently erroring for months, the retention window doesn't reach back far enough, or the backup system itself was encrypted first. Modern ransomware crews disable your safety net before they cut the rope.
Here’s how to check if yours is working: Ask for the date of the last successful restore test rather than the last backup job. It needs to be the last time someone actually pulled data back out and confirmed it worked. If nobody knows or you can’t remember the last time it was done, schedule one this month.
Ransomware crews act during unusual hours, and they're not shy about why. Attacks detonate overnight and on weekends because response is slowest when nobody's watching. A cyberattack that starts in the middle of the night on a Saturday and gets noticed Monday morning has had many uninterrupted hours to spread, encrypt, and exfiltrate.
This is the structural gap that small internal IT teams, often excellent ones, simply can't close. One person, or five, cannot provide genuine 24/7 coverage. It's the reason managed detection and response exists.
Here’s how to test this theory: Ask the middle-of-the-night question to your team. If someone logged in with a stolen credential this Saturday night, who would notice, and how fast? If the answer involves "Monday," you’ll know.
The newest fright on the list, and arguably the scariest, is that voice cloning and deepfake tools have gotten good enough that a fraudster can sound like your CFO, CEO, or biggest client. It’s gotten to the point where it can convince a finance employee to reroute a wire or a helpdesk tech to reset an executive's credentials.
The old verification advice ("call them back") still works, but we suggest going one step further. You’ll need to verify through a second, known channel, and consider a code word for payment changes. A voice is no longer proof of identity. Treat it like a caller ID that is spoofable.
Here’s how to check if your team would get fooled: Ask your finance team what the process is for a payment-change request that arrives by phone. If the answer is "we'd probably just do it," that's the gap.
The remaining frights are the ones we find just as often. It could be shadow IT that your IT team doesn't know about, vendor access that nobody's reviewed since onboarding, the missing incident response plan, and the cyber insurance trap that only reveals itself when you're filing a claim.
We put all thirteen in a single checklist, each with a question, so you can do a full walkthrough of your environment in about ten minutes and see where you stand. Download the 13 Frights Checklist here.