The Data Cymru breach needed only two things: a forgotten Test2 account with Password1, and the same local admin password on every server. Both are cheap to find.

1. Stale and test accounts: in AD, list enabled accounts that haven't logged on in 90+ days or whose names match test/temp/demo/vendor/svc patterns. For example: Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | ?{$_.Enabled}, plus Get-ADUser -Filter 'Name -like "*test*"' -Properties PasswordLastSet,LastLogonDate. Flag any with PasswordLastSet years ago or PasswordNeverExpires. Disable first, delete after an owner confirms.
2. Weak passwords: audit AD hashes offline against a breached and common-password list (for example with a tool like DSInternals' Test-PasswordQuality, run by your security team with approval). Password1 meets old complexity rules, so complexity alone doesn't stop it.
3. Unique local admin passwords: deploy Windows LAPS (built into supported Windows) so each machine's local admin password is random and rotated. That breaks the move from one host to the next with a reused hash. Also deny network logon for local accounts via GPO.
4. Outsourced IT: write into contracts who creates, reviews and removes accounts in your directory, with a quarterly attested list of vendor-created accounts. The ICO faulted both the customer and the provider for leaving that gap.
5. Remote access: require MFA for every remote path (VPN, RDP gateway, admin portals), including service and vendor accounts.