The SMB identity and access management has become the category the enterprise vendor has been ignoring, the category the attacker has been paying attention to, the gap the next breach disclosure will name. The honest framing matters here, because the SMB IAM the enterprise vendor has been skipping sits as the SMB IAM the attacker has been quietly exploiting through the credential the attacker bought from the previous breach.
What follows runs as the working version of the field guide. The shorter version is what the SMB owner and the IT lead actually have time to read.
What the SMB IAM actually looks like
Three things, in roughly that order of how much each one matters. The first runs as the password reuse, where the reuse the SMB employee has been doing across the SaaS subscription, the reuse that means the credential from the previous breach grants the access to the next system, the reuse the SMB has not been able to fix because the SMB has not deployed the password manager. The second runs as the shared account, where the account the SMB has been sharing across the team, the account the former employee still has access to, the account the SMB has not been offboarding because the offboarding requires the formal process the SMB has not formalised. The third runs as the missing MFA, where the MFA the SMB has been postponing because the MFA adds the friction the SMB owner has been complaining about, the MFA the SMB has been treating as the enterprise concern rather than the SMB concern, the MFA the attacker has been counting on not being there.
What the attack pattern is
Three patterns, in roughly that order of how often each one shows up. The first runs as the credential stuffing, where the stuffing the attacker runs against the SMB SaaS, the stuffing that uses the credential from the previous breach, the stuffing that succeeds because the SMB has not deployed the MFA, the stuffing that gives the attacker the access the attacker uses to invoice the SMB customer. The second runs as the phishing for the credential, where the credential the attacker phishes from the SMB employee, the credential the employee enters on the lookalike site, the credential the attacker uses to access the SMB email, the phishing that the SMB email filter should have caught but did not. The third runs as the insider enablement, where the enablement the disgruntled employee has been using the still active credential the SMB has been failing to revoke, the enablement that lets the employee walk out the door with the customer list, the enablement the SMB has been treating as the HR problem rather than the IAM problem.
What the SMB can do
Three moves if you are the SMB owner or the IT lead who has to improve the IAM without buying the enterprise platform the enterprise vendor has been selling. Deploy the password manager, because the manager (the 1Password, the Bitwarden, the Dashlane) the SMB can deploy in a day, the manager that fixes the password reuse problem, the manager the SMB can pay for with the per seat license the SMB can afford. Turn on the MFA on every account, because the MFA the SaaS provider already offers, the MFA the SMB just has to flip on in the admin console, the MFA that the SMB should require on the email, the banking, the payroll, the customer relationship management, the MFA the attacker cannot defeat without the second factor. Write the offboarding checklist, because the checklist the SMB has been postponing, the checklist the IT lead can write in an hour, the checklist that names every system the employee had access to, the checklist the IT lead runs on the day the employee leaves. The SMB that deploys the manager, turns on the MFA, and writes the checklist serves as the SMB that has improved the IAM without buying the platform.
The bottom line
SMB IAM in 2026 sits as the category the vendor has been ignoring and the attacker has been exploiting. The password reuse, the shared account, the missing MFA, those three are what the SMB IAM looks like. The credential stuffing, the phishing, the insider enablement, those three are the attack patterns. The password manager, the MFA on every account, the offboarding checklist, those three are the moves. The SMB that does the three holds the line. The SMB that has not done the three serves as the SMB that finds out the gap on the morning the attacker invoices the customer.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
