The Business That Depends on One Inbox.

Ask a business owner what would happen if their key operations person disappeared tomorrow, a resignation, an illness, a lottery ticket, and you'll usually get a nervous laugh and a subject change. Everyone knows there's a person like that. Almost nobody has looked at exactly how deep the dependency goes.

Most owners have not considered that the dependency is measurable. It's sitting in the tenant.

Look at what a scan can actually see. One account holds the global admin role, and has for six years. The same account is the registered contact on the domain, the billing owner on the Microsoft agreement, the approver on the multifactor resets. The company's critical vendor accounts, the bank portal, the payroll system, the line-of-business app, all route their notifications and password resets to one mailbox. Shared credentials for half the company's tools live in that person's saved passwords or, worse, in a spreadsheet only they know about. The org chart says this person is the office manager. The configuration says this person is the company.

That's key person risk, and it's not a personality judgment. Usually the person carrying it is the most dedicated employee in the building. Concentration happens precisely because they're reliable: every orphaned responsibility drifted to them over a decade because they were the one who'd handle it. Nobody designed the single point of failure. It accreted.

But accretion isn't a plan, and the failure mode is brutal. The day that person is unavailable, the company discovers it can't reset passwords, can't access the domain registrar, can't approve the wire, can't get into the system that runs the shop floor. I've watched businesses lose weeks to this. Not to a hacker. To a departure.

This is a finding that lands differently than anything security-related, because it's not about attackers at all. It's about continuity, and owners feel continuity in their gut. Put the concentration map on the table, this account, these roles, these registered dependencies, and the conversation starts itself. Then the remediation is refreshingly human: distribute admin roles, document the vendor accounts, move password resets to a monitored mailbox, get the credentials into a managed vault, cross-train a second person.

Succession planning sounds like something for family lawyers. In a small business, half of it is an IT problem, and it's one of the most valuable problems an MSP can solve. The bus factor is real. The good news is that for the first time, you can actually see it.