Decide the Tier, Not the Exception

Sun, 01 Nov 2026 00:00:00 +0000

Not that long ago, removing local admin rights was the project nobody wanted to start. We’d have to package every tool anyone had ever installed, the argument went, and the endpoint team would drown in configuration sets.

Today it’s standard, and looking back, two things did most of the work. Auto-updates took the pressure off packaging. And users minded far less than IT had assumed, with EPM covering most of the rest.

That second point has stayed with me, because I think we’re repeating the mistake with hardening.

Attack Surface Reduction on Phillip Büchler

Decide the Tier, Not the Exception