From 10 to 100 Employees: How to Keep Access Under Control as Your Team Scales

Growth Creates Chaos (If You're Not Ready)

Going from 10 to 100 employees is one of the most exciting phases of a company's life. It also introduces a category of problems that simply don't exist at smaller scale — and access management is one of the biggest.

At 10 people, everyone knows what everyone else has access to. The founder set up most of the accounts personally. Permissions are informal but manageable. Then you start hiring aggressively, and suddenly you're dealing with:

• New hires getting "the same access as [person X]" without anyone checking what X actually has
• Permissions accumulating over time as people change roles but never lose their old access
• Contractors and agencies with deep access that nobody tracks
• Interns ending up with admin access to production because they inherited it from a template

Access Challenges at Every Growth Stage

Stage 1: 10-25 Employees

The "everybody knows everybody" phase. Access is managed informally. The CTO or a senior engineer sets up accounts manually. There's no formal process, but the team is small enough that problems are caught quickly.

Common issues: Shared passwords for team accounts. Everyone has admin access to everything because "it's easier." No documentation of who has access to what.

Stage 2: 25-50 Employees

The "cracks appear" phase. You're hiring across multiple teams. Not everyone knows each other. The first compliance or security incident happens, and someone asks "who has access to what?" for the first time.

Common issues: Permission creep — early employees have accumulated access across dozens of tools. Departing employees retain access because nobody has a complete list of their accounts. Multiple people can grant access with no approval workflow.

Stage 3: 50-100 Employees

The "we need a system" phase. Teams are specialized. There are departments you don't interact with daily. Compliance requirements (SOC 2, customer security questionnaires) start driving the need for documented access controls.

Common issues: Nobody has a complete picture of the company's access landscape. Spreadsheet-based tracking is hopelessly outdated. The cost of a security incident has grown significantly with the customer base and data volume.

Stage 4: 100+ Employees

The "this is a real problem" phase. You probably need (or already have) someone dedicated to security or compliance. Enterprise customers are demanding SOC 2 Type II certification. The attack surface is large and growing.

The Permission Creep Problem

Permission creep is the gradual accumulation of access rights beyond what a user needs for their current role. It's one of the most common and dangerous access problems in growing companies.

Here's how it typically happens:

1. New hire gets access to tools needed for their role
2. Temporary project requires access to additional tools — granted, never revoked
3. Role change adds new permissions but old ones remain
4. Troubleshooting escalates access to admin level — never demoted back
5. Result: A marketing manager with admin access to AWS, a designer with write access to production databases, an intern with org-owner permissions on GitHub

The principle of least privilege — giving users only the minimum access they need to do their job — is a foundational security practice. But without visibility into current permissions, it's impossible to enforce.

Building an Access Management Framework That Scales

1. Centralize Visibility

Before you can manage access, you need to see it. Connect all your SaaS tools to a single dashboard that provides a real-time view of who has access to what. This becomes the single source of truth that grows with your team.

2. Define Role-Based Access Templates

Create standardized access profiles for each role (engineer, designer, marketer, etc.). When someone new joins, they get the template for their role — not a copy of what someone else accumulated over two years.

3. Implement Regular Reviews

Set up weekly automated scans that flag:

• Users with more access than their role template defines
• Admin accounts that haven't been active in 30+ days
• Access grants that happened outside of normal workflows
• Former contractors or employees with active access

4. Make Access Changes Easy

If granting or revoking access requires logging into 5 different admin consoles, people will take shortcuts. One-click provisioning and deprovisioning across all tools removes the friction that leads to security gaps.

The best access management system is one that grows with your team automatically. You shouldn't have to hire a dedicated IT person just to know who can access your production database.

How ViglaFort Grows With Your Team

ViglaFort is built for the 10-200 employee sweet spot — companies that are growing fast but don't yet have (or need) a dedicated IT security team. It provides:

• Automatic discovery of all users and permissions as you add tools
• Dashboard showing access growth trends over time
• Alerts when someone gets unusual or elevated permissions
• Weekly access reviews that catch over-provisioned accounts
• AI assistant for natural language access queries and actions