The password nobody owns: Taking machines to zero standing privilege (ZSP)

Ask your infrastructure lead who owns the service account behind the overnight finance batch and notice how long the answer takes. In many of the environments I’ve reviewed, the engineer who set it up left years ago and the password has been sitting in a vault, or sometimes a plain config file, ever since. It usually still carries permissions sized for a migration that wrapped up before anyone on the current team joined, so people leave it alone rather than risk breaking something nobody fully u