The Season Nobody Flags as a Security Risk
Walk into almost any HR office in Massachusetts right now and you’ll find the same thing: a browser tab open to a benefits enrollment portal, a spreadsheet tracking who elected which plan, and an inbox full of scanned dependent verification forms. Open enrollment runs through late fall at most small and mid-sized businesses, and for a few weeks, HR handles more sensitive personal data, Social Security numbers, dates of birth, dependent records, than it does the rest of the year combined.
Nobody budgets extra security attention for this period. They probably should. At Cloud9 Tech Solutions, we see this exact pattern every fall: more sensitive data moving through less supervised channels, right on schedule.
What the Data Actually Shows
Kaseya’s 2026 SaaS Security Report, built from more than 27 billion security events across over 50,000 SMB environments, found that 69 percent of monitored SaaS accounts were unmanaged guest accounts, outnumbering licensed users by nearly two to one. The same report found 56 percent of accounts had no active multi-factor authentication, and only 27 percent of SMBs enforced MFA organization wide. Inside Microsoft 365 specifically, 45 percent of shared files were sent outside the organization entirely.
A separate CloudEagle survey of IT and security leaders found that roughly one in two employees hold more system access than their job actually requires. Only 15 percent of organizations have adopted just in time access, where permissions are granted temporarily and expire on their own. Half of respondents said privilege creep was a common problem in their environment, yet only 5 percent enforce least privilege policies to actually stop it.
Put those numbers next to a typical enrollment season and the picture gets uncomfortable fast. A benefits broker’s platform added as a guest account two years ago that nobody ever removed. A shared HR mailbox that’s survived three reorganizations. A departed employee’s login that still opens the same shared drive where this year’s dependent verification scans happen to be sitting.
The Access Nobody Remembers Granting
Enrollment season adds a specific wrinkle most access reviews miss entirely: the number of outside parties who legitimately need to touch HR data for a few weeks, then don’t need it again until next year. A benefits broker, a payroll provider’s implementation team, sometimes a third party administrator handling a specific plan, each one typically gets some form of access to make the process work, and that access rarely has an expiration date attached to it.
The result is a small, quiet pile of standing accounts that only ever get used in a short annual window. Nobody checks them in the other eleven months, which is exactly the kind of account an attacker, or a departed employee who still remembers a password, is most likely to find useful, because nobody’s watching it either.
Why This Hits Smaller Businesses Harder
It’s tempting to read those statistics as an enterprise problem, something that happens at companies with thousands of logins to track. The opposite is closer to true. Large organizations usually have dedicated identity teams running scheduled access reviews, smaller businesses almost never do, and that’s exactly where guest accounts and stale permissions pile up unnoticed, nobody’s job is to go looking for them.
The cost of that gap isn’t theoretical. A single exposed benefits file, a scanned ID, a Social Security number sitting in a shared folder that a dozen former employees can still technically open, is enough to trigger a breach notification requirement under Massachusetts law. Massachusetts’ own data security regulation, 201 CMR 17.00, already expects businesses holding this kind of personal information to have a written information security program in place, which most small businesses have never formally written down, let alone reviewed since last year’s enrollment season. By the time anyone notices a problem, the enrollment window has closed and the data has already moved through months of email threads. That process costs time, legal fees, and client trust, three things a small business has far less room to absorb than it looks like on a compliance checklist.
What Actually Helps, Starting This Week
- Run an access review of every account connected to HR or benefits systems, including vendors, brokers, and anyone who changed roles in the past year.
- Turn on multi-factor authentication for every account handling sensitive data, not just the administrator logins.
- Remove guest and vendor accounts that outlived whatever project created them, especially anything tied to a prior benefits platform or broker.
- Set a calendar reminder, not a policy nobody reads, to revisit broker and vendor access again once enrollment closes, rather than letting it quietly roll over into next year.
None of that requires new software or a big project kickoff. It requires someone to actually look, and to run on a security stack with identity and access controls built in, rather than bolted on after something goes wrong.
Frequently Asked Questions
Does a small business really need to worry about broker and vendor accounts, or is this mainly a large-company problem?
It’s actually the opposite. Larger companies tend to have dedicated staff running scheduled access reviews. Smaller businesses usually don’t, which is exactly why broker, payroll, and benefits vendor accounts tend to sit unreviewed the longest in an SMB environment.
What counts as sensitive enough to need protecting during enrollment?
Social Security numbers, dates of birth for employees and dependents, scanned IDs or verification documents, and anything tied to a specific health plan election. If it would matter on a breach notification form, it matters here too.
How long does a basic access review actually take?
For most SMBs it’s a matter of hours, not weeks, once someone sits down with a list of every system touching HR or benefits data and checks who can currently get into each one. The hard part is remembering to do it, not the time it takes.
The Takeaway
Open enrollment isn’t going to stop generating this kind of exposure on its own, and the accounts left open after it closes are the ones most likely to still be open next fall too. The fix isn’t complicated, and it doesn’t require a new budget line: know who has access, turn on MFA everywhere it’s missing, and close out the accounts nobody’s using anymore. The businesses that get caught out aren’t the ones without a security plan on paper, they’re the ones who wrote one once and never looked at it again.
If your business hasn’t reviewed who can see what in the past year, enrollment season is as good a reason as any to start now, not in January. Schedule a free security assessment with Cloud9, and we’ll tell you exactly what we find.