Most breaches escalate the same way. An attacker gets ordinary access, finds a credential with more privilege, and uses it. The controls that stop this are unglamorous and mostly free.
Start by separating administrative identities from daily-use ones. An engineer who reads email, browses the web and runs production commands from the same account has collapsed every boundary that would otherwise contain a compromise. A second account used only for privileged work is the single highest-value change available.
Then remove standing access. Most people who need administrative rights need them occasionally, not permanently. Just-in-time elevation — where access is requested, granted for a window and automatically revoked — is available in the major cloud platforms and in several open-source tools. It shrinks the period during which a stolen credential is useful.
Shared accounts are the next problem. The root account, the database superuser, the domain administrator. These cannot be removed but they can be locked away: strong unique credentials in a vault, hardware-backed multi-factor authentication, and an alert whenever they are used. Their use should be rare enough that an alert means something.
Log privileged sessions and keep the logs somewhere the privileged accounts cannot reach. An attacker with administrative access will try to clear their tracks, and a log store that the compromised identity can delete provides no evidence at all.
None of this requires buying a privileged access management product. Those products help at scale. A company with twenty engineers gets most of the benefit from separate admin accounts, a password vault, enforced multi-factor authentication and an immutable audit log.
