Here is an example of why you need to assume breach, and reduce accounts with overly wide permissions.

https://www.europol.europa.eu/sites/default/files/documents/cyberbits_04_ocean13.pdf