Why local admin rights are expensive

Nov 12, 2026

Earlier this month Binance published its first research report on the largest crypto heist ever: some 6.3 billion dollars, most of it gone in twenty minutes. The interesting part is not the amount. It is how it started, and that beginning was anything but spectacular. In fact, it could have happened in your company.

In June an engineer on Binance's wallet team was looking for an AI tool to help him write code. He googled, clicked an ad among the results and installed what looked like Homebrew, the package manager almost every Mac developer uses. It was a tampered copy. The installation did not ask for an admin password, because everything ran inside his own user profile, and that was allowed. Afterwards the malware quietly swapped a common Python tool on his laptop for a copy that kept in touch with the attackers.

Binance spotted it, replaced the laptop and rotated every credential. A good response, and a fast one. But the attackers had learned something that cannot be undone: this man's role, and who else managed the wallets next to him.

In September they came back. A second engineer was on a job site, with Binance on his profile. Someone posing as a project director held two interviews with him, with credible details, up to a second round with a fake CEO over a chat app. Then came the assignment: download this code and run it. Which device, the fake recruiter never said. He did not have to. All he had to do was hope the engineer would use his work laptop, and that is exactly what happened. The security on that device saw nothing, the malware was built to stay unnoticed. At the end of October the attackers logged into a third colleague's computer, rolled out a container with stolen credentials and ran a script against the service that signs every transaction. Not a single private key leaked. The FBI attributes the theft to a North Korean group that already took 1.5 billion dollars from a competitor in 2025, again through one compromised developer machine. According to the report the attackers even used an internal AI tool along the way to move between the engineers' devices. How that worked, Binance has not said.

This is not a crypto story

You may think: crypto, developers, a foreign power, we do not have that. Look at the mechanism, not the scenery. Someone wanted a tool to do his work better. The organisation did not offer it along an approved path. The rest followed by itself: a search ad, a download, and a laptop that from that moment belonged to someone else.

That mechanism runs through every SME. Not with wallets, but with pdf converters, screen recorders, zip openers, download managers and lately all sorts of AI assistants. Whoever waits too long for IT finds a solution alone. Plenty of software installs into the user profile without a single admin prompt. Local admin rights only make it more comfortable: then the lot can nestle in the system folders and put security out of play.

The same pattern drives the stories that never touch a crypto exchange. The same weeks brought news that a US Army contractor had hooked his own AI agent to a production system, with its own login. According to anonymous sources, that agent sent passwords and a network map to a website flagged as risky two months later. The contractor calls the accusations baseless, so the details are disputed. You recognise the pattern at once: someone took the fastest route with a tool IT had never approved, and nobody saw it.

The fear of losing productivity

When I propose phasing out local admin rights at customers, I always get the same reaction. "Our people solve things themselves, that is exactly our strength. If they have to open a ticket for every little install, we lose a day a week."

That fear is not stupid. It is just based on the wrong trade-off. The choice is not "install freely or wait for IT", but "a regulated path or a path nobody knows". The productivity you gain with free install rights, you pay back at a moment you do not choose: the day someone clicks the wrong ad. And that day comes. On almost half the devices we inventory at SMEs there is software nobody manages anymore, nobody updates anymore, and nobody remembers where it came from.

The other extreme works no better. Locking everything down and hoping people will simply stop creates exactly the shadow corners where things go wrong. As one of the Blue Security Podcast hosts put it this week: if you do not give your people tools, they will go looking for them. They always find a way. The only question is whether that way runs through IT or around it.

Give first, then take away

So the solution is not less freedom, but a better path. Whoever takes app curation seriously first gives people something: a Company Portal with the approved tools, a request route that delivers within a day instead of within two weeks, and a clear agreement on what is allowed to happen automatically. Only then do you take away admin rights, role by role, with exceptions that are registered and logged instead of quietly existing.

Can you close it off completely?

Then the question I was asked this week, and a fair one: without admin rights, what stops someone from installing something in their own user profile? Nothing. That is the gap. Installing into the user profile asks no elevated rights, and the software runs there just fine.

Microsoft's answer is called App Control for Business, managed through Intune and the grown-up successor of what used to be known as WDAC. The principle is an allowlist that sits deeper than the user account: code that is not explicitly trusted does not start, not even from the user profile. With the managed installer mechanism, everything IT rolls out through Intune is automatically trusted, so the approved path keeps running smoothly. Anyone who used to work with lists of trusted installers based on NTFS ownership recognises the idea. Instead of manually maintained lists, it is now central policy.

Honesty requires saying: this is not a switch you flip. Maintaining the rules is real work, and an over-enthusiastic rollout can leave laptops half unusable. The sensible route is step by step: start in audit mode, where the system records what would have been blocked without blocking anything. Test on one department and expand to the places where the pain is greatest, such as finance and the admins' own machines.

And for what does need elevated rights, there is now Endpoint Privilege Management: elevation per application, per rule, with a decision and a log every time. The user stays a standard user and only gets one step up for that single approved action. EPM sits in the Intune Suite and therefore carries a price tag. In smaller environments, a well-set-up Company Portal with a fast request route can achieve the same.

One thing must not be forgotten here: curation without updates is no security gain. An approved app that never gets updated again is exactly the door the Binance story started with, only with an inviting dot on the mat.

What you can do this month

1. Inventory what runs today. You cannot curate what you do not know, and the result is always worse than expected.
2. Build the approved path first. Company Portal, a fast request flow and an agreement on turnaround times. Only once that is in place does taking something away make sense.
3. Phase out local admin rights per role. Use EPM or a comparable mechanism for the real exceptions, with logging instead of silent deviations.
4. Close the user-profile gap where the pain is greatest. App Control for Business, first in audit mode, only then enforced. And keep the approved list current: a curation list is a living document, not a one-off project.

The Binance engineer did nothing stupid. He wanted a tool to do his job and took the fastest route the system offered him. As long as your people can make that choice every day, the question is not whether someone clicks the wrong ad, but when. Doubtful about what runs on your devices and who has admin rights? An audit gives you an honest answer within days.

Book a no-obligation conversation or request your audit. Want to build a first picture yourself first? Our step-by-step plan from zero measurement to a secure workplace describes the route, from free scan to improvement plan.