Locked Out of Your Own Business

No villain anywhere in the story. A password reset that went sideways. A "suspicious activity" flag from a hotel Wi-Fi login. A subscription card that expired quietly. An MFA prompt going to a phone that no longer exists. And - the classic - a recovery email pointing at a mailbox that was deleted when an employee left in 2022. The door didn't just lock; the keyhole moved.

Your supplier's security is pointed at you too

Here's the structural truth nobody puts in the brochure: every protection a cloud platform builds against attackers is also, mechanically, a thing that can lock you out. The same systems that stop a criminal resetting your password will stop you, with perfect impartiality, the day your recovery details are stale. The platforms aren't being unreasonable - from the outside, a stressed owner who's lost their credentials looks exactly like the attacker the system was built to refuse.

What's changed is the stakes. A modern small business doesn't use these platforms; it lives in them - email, files, invoicing, payroll, customers. That's mostly been a good trade. But it means a lockout isn't an IT inconvenience anymore. It's the whole business standing in the car park. Availability, again: nothing stolen, nothing corrupted, everything simply out of reach.

And the recovery process, once you're in the hole, is genuinely hard - deliberately hard. Identity checks, waiting periods, support queues with no number to ring. Microsoft documents its admin-recovery path, Google documents its administrator recovery (Google Workspace Admin Help, 2026) - and both processes work far better for businesses that prepared than for businesses that arrive desperate. The preparation, it turns out, is about an hour.

The hour that keeps the keyhole where you left it

Walk your critical platforms - the email tenancy first, because email is the master key to everything else - and check five things while you're calm.

That recovery details are current and reachable: the phone number is yours, the recovery email is a live mailbox you control, not a departed staff member's ghost. This check defuses the most common way owners end up locked out of a Google account or a Microsoft 365 tenancy.

That there's a second way in: a second admin account (a "break-glass" account, in the trade) with its own strong passphrase and its own MFA, stored offline and used never. One person with sole admin is a bus factor of one wearing a different hat.

MFA needs a fallback that isn't the same phone - printed recovery codes, filed with the run book.

That billing won't quietly fail: which card the subscription bills, when it expires, who gets the warning emails. More businesses lose access to ordinary non-payment than to anything dramatic.

And that you hold your own data, not just access to it. A periodic export - mail archives, files, the accounting data - sitting in your own backup means the worst lockout becomes a bad fortnight instead of an extinction event. Access and possession are different things; rent the first, but own the second. The same rule as a backup you've actually restored.

The longest lockout I've watched ran weeks - a business arguing with a support process for the keys to its own information, every day of it self-inflicted in the gentlest sense: every step of the recovery would have been trivial if the details had been current. I've never once seen the prepared version take more than a morning.

The cloud didn't make your business fragile; in most ways it made it tougher. But it did move the keyhole onto someone else's door, and that means the way back in is now a relationship you maintain, not a locksmith you ring. Go and look at your recovery settings today - not because you've been attacked, but because right now, while everything works, is the only time checking them is easy.

When did you last look at where your keyhole actually is?

---

Sources

• Google, Recovering administrator access to your account (Google Workspace Admin Help) - retrieved 14 August 2026
• Microsoft, Reset passwords - Microsoft 365 admin - retrieved 13 June 2026
• Red Bridge Cyber, perspective: Your Phone Is Now a Single Point of Failure
• Red Bridge Cyber, perspective: The Third Word in the Definition of Security
• Red Bridge Cyber, perspective: A Backup You Haven't Restored Is a Hope, Not a Backup