Your business doesn't die from a hacker. It dies from an expired credit card.

Your business doesn't die from a hacker. It dies from an expired credit card on your DNS registrar, a deploy pipeline that lives in one contractor's head, or a laptop that holds the only copy of your accounting file.

Single points of failure are silent until the day they're everything. And small teams have more of them, not fewer — you don't have redundancy budgets, you have one router, one admin account, one person who knows the deploy sequence.

The fix is a two-hour audit you can run once or twice a year. Here's the whole method.

Walk the wire

Pick your three most critical flows — for most teams: a customer buys something, money reaches your account, a customer reaches you. Trace each one as a chain and, for every link, ask one question:

What else provides this?

If the answer is "nothing," you found a SPOF. One level deep is enough — mapping four levels deep produces a diagram nobody reads.

Trace "a customer buys something":

1. Customer opens the site → DNS registrar → hosting → CDN. The registrar is the classic kill: auto-renew off, card expired, single admin. Businesses die of expired credit cards, not elite hackers.
2. Payment is authorized → one payment processor. Account freezes are the small-business outage. Read your contract's fund-hold clause before you need it.
3. Confirmation is sent → one email provider + your SPF/DKIM/DMARC records. Can you rebuild those records offline if the domain console is locked?
4. Staff diagnose failures → one laptop with admin creds, one 2FA device, one password manager. If the only owner account's phone goes to the bottom of a lake, so does your access.

A four-person team typically surfaces 10–18 single points of failure on the first pass. That's normal. That's the point — the audit converts vague dread into a ranked list.

The eleven usual suspects

1. The domain registrar (card expired, auto-renew off)
2. The payment processor (single provider, freeze risk)
3. The single admin account (owner rights on domain + store + email)
4. The one laptop (local-only books/design sources)
5. The office network (one router, one ISP, one circuit)
6. The contractor with the keys (DNS + hosting + deploys, replies weekly)
7. The third-party integration (webhooks/shipping/tax with no documented fallback)
8. The SSL cert and the unmonitored cron job (both kill the site quietly)
9. The shared inbox (one password, one phone, no delegates)
10. The physical key (server cabinet, mail room, the only dongle)
11. Knowledge in one head (deploy sequence, vendor contacts, router password)

Score it: blast radius × likelihood

You don't fix everything — you triage:

• Stops revenue + no redundancy → fix now, this week.
• Stops revenue + solid → document + alert on it, revisit next audit.
• Stops one workday → cheap fallback: spare adapter, printed contact list, delegate access.
• Cosmetic → accept it in writing. A written accepted risk is a decision; an unwritten one is a surprise.

The cheap row does more for morale than the expensive one. Most SPOFs die to a $0 fix: a second admin account, auto-renew on, a password in a shared vault, a printed recovery page.

Worked example

A five-person agency ran the audit on a quiet Friday. Top finding: their DNS registrar account sat on a founder's personal email, auto-renew disabled, card expired in March. Total blast radius — no DNS means no email, no site, no client campaigns. Fix: twenty minutes, a second admin, registrar lock on. Second finding: an offshore contractor held sole deploy access to a client site. Fix: shared vault entry and a one-page handover runbook — not a confrontation.

Two hours, two 20-minute fixes. The alternative was reading this story as news instead of fiction.

The register

Paste this into your ops docs and fill it as you walk:

date,system,dependency,second_provider,blast_radius,likelihood,action,owner,review_date
2026-09-12,website,DNS registrar,none,total-kill,medium,card+autorenew+2nd admin,owner,2027-03-01
2026-09-12,checkout,payment processor,none,total-kill,low,2nd processor dormant,sam,2027-03-01
2026-09-12,deploys,contractor creds,none,blocking,medium,vault entry + runbook,alex,2026-12-01
2026-09-12,office,printer firmware key,none,annoyance,low,accepted in writing,sam,2027-03-01

Every catastrophic-blast-radius row becomes a scenario your disaster recovery plan must answer. Re-run after any big change — new processor, new office, new hire — and once a year regardless.

---

The full audit with the worked example and the walk-the-wire table is on the Hive80 Lab ops-notes site — free, no signup.

If you want the whole incident-response stack pre-built, the Ops Starter Kit ($14) bundles severity matrix, IC checklist, comms templates, and the first-30-minutes card. The Ops Field Cards ($4) are 12 printable checklists for the war-room wall, and the Ops Mega Bundle ($29) is all five kits in one download.

50% off everything with code LAUNCH50 at checkout.

Related reading: Key-Person Dependency Checklist (the human SPOFs) · User Access Review (the account nobody removed) · Backup Restore Drill (the backup that was never tested).