Meet Fred: The Man Who Worked in Accounts, Conveyancing, Reception and Management at Once

Fred does not exist. Fred is what five different employees at a regulated UK professional services business had taken to calling the shared SharePoint login they all used to access company data. Accounts. Conveyancing. Reception. Management. All of them, at various points, were Fred.

This is a real, anonymised finding from a recent compliance audit, and it’s exactly the kind of detail that gets lost when compliance gets reduced to a debate about certificates and paperwork.

The Business That Fought Every Control

The client engaged a security consultant specifically because they needed to improve their security position, with Cyber Essentials certification as part of the destination. The initial environment review found more than one problem.

Multiple staff were using shared identities for routine work, including the SharePoint login nicknamed Fred. Several machines in daily use were up to twelve years old, some running with just four gigabytes of RAM, hardware that had already been flagged internally for replacement years earlier and never actioned.

Every proposed fix became a fresh negotiation. Individual named accounts instead of shared logins. Supported, current devices instead of decade-old hardware. Modern authentication instead of static passwords. None of these are exotic requests. All of them met resistance.

Why Shared Logins Are Worse Than They Sound

If five people are using one identity and something gets deleted, downloaded, shared, or changed, there is no reliable way to determine who actually did it. That’s not a hypothetical risk. It’s the practical, immediate consequence of the arrangement, and it applies whether the change was innocent, accidental, or malicious.

Ask this business “who accessed this file last month” and the honest answer is: we don’t know, because several people were logging in as Fred. That’s not a minor administrative gap. It’s the destruction of one of the most fundamental properties any security system depends on: accountability. Once identity stops meaning identity, everything built on top of it, access logs, incident investigation, insurance claims, becomes questionable.

The Business That Didn’t Fight

A second client, a small accountancy practice handling similarly sensitive client and financial data, needed comparable work. Licensing needed rationalising. Identity controls needed improving. Devices needed bringing under stronger management. This was not a business with nothing to fix.

The difference was how each proposed change landed. Move everyone onto Microsoft 365 Business Premium for the security and management stack it provides: agreed, done. Conditional access enforcing MFA: done. Better device management: happening. Passkeys being rolled in alongside MFA: in progress.

When a control was proposed and the reasoning explained, the business asked a question if they needed to, made a decision, and moved on. They weren’t spending money because they loved compliance. They were cost-conscious like any small business. The difference was that they argued about price when needed, never about whether the requirement itself made sense.

The Six-Month Test

Imagine auditing both businesses six months later, because that’s the test that actually matters.

At the accountancy practice: who accessed this file? Named user identities, with conditional access enforcing MFA and sign-in logs available on request. Can this unmanaged laptop access company data? Policy says no, and the logs confirm it.

At the professional services business: who accessed this file, historically? Nobody knows, because Fred was accounts, conveyancing, reception and management, simultaneously, depending on who was logged in that day.

One business can prove its controls. The other can only assert them. That gap is precisely what a Cyber Essentials audit, an insurer’s claims investigation, or an ICO enquiry following a genuine breach would expose immediately.

Friction, Not Budget

It’s tempting to explain the difference as one business having more money than the other. That’s too simple, and it’s not accurate. Both are cost-conscious UK small businesses operating in regulated sectors with real budget constraints. Uncovering deferred maintenance, twelve years of it in the first case, can reveal genuine and uncomfortable costs that a business wasn’t expecting, and that’s a real pressure worth acknowledging honestly.

But there’s a meaningful difference between “we can’t fix everything immediately, so let’s prioritise the risks and build a plan” and “we don’t want to replace this laptop because it was working fine last week.” The first is a legitimate budget conversation. The second is an argument with reality, dressed up as a budget conversation.

Cyber Essentials didn’t make a laptop twelve years old. Time did that. Cyber Essentials didn’t make five people share an identity. Somebody chose that, repeatedly, over years, for convenience. Compliance simply walked into the room, switched the light on, and asked why the carpet was moving.

What This Means for Your Business

1. Check for shared logins across your entire business today, not just the obvious ones. Shared SharePoint access, a generic “office” email account treated as a login, a single admin password used by multiple staff. If you can’t name who did something, you’ve found your Fred.

2. Audit your device fleet by age, not just by whether it currently works. A machine still turning on is not the same as a machine still safe to use. Twelve years and four gigabytes of RAM is not an edge case; it happens more often than most businesses admit.

3. Separate “we can’t afford to fix this immediately” from “we don’t want to.” The first deserves a prioritised remediation plan. The second deserves an honest conversation about what you’re actually protecting by resisting.

4. If a security recommendation meets resistance, ask whether the objection is about cost or about the requirement itself. Those are two entirely different conversations, and conflating them is how businesses end up with a Fred.

Source	Article
NCSC	Cyber Essentials overview and requirements
ICO	Security (GDPR guidance)
GOV.UK	Cyber security breaches survey 2025/2026