One of the biggest obstacles to eliminating unauthorized access is determining how many people have it. Access lists are particularly difficult to formulate in both mature companies, where the number and power of administrators have expanded over periods of years, and small companies, where rapid growth leads to undocumented tangles of administrators who are able to maintain their access because nobody has time to assess their status.

Currently, only the largest companies are aggressively pursuing technology that will enable them to tighten up their internal security, while many other firms are simply hoping that they will be able to get by without significant changes, which is a high-risk strategy, given the many possible negative outcomes.

"Realistically," says Loewenthal, "you're not going to be able to stay in business very long if the information leaks out of your company like a sieve. You really do have to make sure you are protecting and placing safeguards around it."