It is Halloween week, so forgive us a little fun. But here is the uncomfortable truth behind the costumes: most businesses really are haunted. Not by anything supernatural, but by five very real monsters that lurk quietly in their IT, usually for years, until the night one of them bites.
Walk through this list and count how many are living in your business right now. Then read on for the good news: every one of them is easy to banish, and none of them survive daylight.
1. The ghost accounts
Somewhere in your systems are the ghosts of employees past: logins for people who left months or years ago, still active, still able to open email and files. Nobody thinks about them, which is exactly what makes them dangerous. A ghost account is a door into your business that nobody is watching, often with a password that was reused somewhere else and has long since leaked.
The exorcism: a leavers process. The day someone leaves, their accounts are disabled, their licences freed, their access gone. Five minutes of ritual, and the ghost never forms. Access control like this is also a core part of Cyber Essentials, if you want it done to a standard.
2. The zombie licences
Subscriptions that refuse to die. The licence bought for a starter who became a leaver, the plan sized for a team twice this size, the tool somebody trialled in 2024 that still shuffles through your bill every month, arms outstretched, moaning quietly. Individually small, collectively a real number, and they multiply in the dark.
The exorcism: an hour with the licence list before renewal season, which we covered in our plain-English guide to cloud IT services. It is routinely the easiest money a business saves all year.
3. The vampire in the inbox
Here is a detail from the old stories worth remembering: a vampire cannot enter your house unless somebody invites it in. Most cyber attacks work exactly the same way. The phishing email sitting in an inbox right now is powerless until someone clicks the link, opens the attachment, or types a password where it should not go. One invitation is all it takes.
The exorcism: a team that knows the warning signs and a culture where pausing to check is normal. Our guide to spotting phishing emails is the garlic. Multi-factor authentication is the crucifix: even a stolen password is not enough on its own.
4. The mummy in the server cupboard
Wrapped in dust and cables, entombed in a cupboard nobody opens, sits a machine from another age. It has been running so long that nobody remembers quite what it does, only that everything stops when it sleeps. Every year it survives makes the eventual unwrapping more frightening, because ancient hardware does not retire gracefully, it collapses suddenly, usually in the busiest week of the year.
The exorcism: do not wait for the tomb to open itself. Plan the succession: what runs on it, where it should live instead (often the cloud), and when it gets decommissioned. We wrote about budgeting for exactly this in our 2027 IT budget guide, because a planned replacement is a line item, and an unplanned one is a horror story.
5. The coffin nobody has opened
The scariest monster on this list is the quietest one. Your backups report "success" every night, green ticks all round. But a backup nobody has ever restored from is a sealed coffin: you believe something useful is inside, and you are planning to find out for certain on the worst day of your business life.
The exorcism: open the coffin on a quiet afternoon. Restore something. Time it. Check the things that matter are actually in there, including Microsoft 365. We wrote a whole piece on what happens to businesses that skip this, and it is the only genuinely frightening link in this article.
None of these monsters survive daylight
Notice what every exorcism above has in common: none of them are expensive, and none of them are complicated. Ghost accounts die to a checklist. Zombie licences die to an hour with a spreadsheet. The vampire needs the whole team to simply stop inviting it in. The mummy needs a plan, and the coffin just needs opening while nothing depends on it.
The monsters survive on one thing only: nobody looking. Which makes Halloween as good a prompt as any.
Fancy a fright-free audit?
If you would rather someone else went monster-hunting, this is a normal part of how we look after businesses: our cyber security and managed IT support work covers the leavers process, the licence hygiene, the phishing defences, the hardware plan and the tested backups, routinely, so nothing gets the chance to lurk.
Happy Halloween. May your only scares this week be the ones at the door asking for sweets.