Organizations should apply principles of least privilege to mitigate threats, security researcher says.