we have a f****d up bastion not connected to joiners-leavers process. 1st is with a well-known, default password that forces a first reset. there are plenty uninitialized accounts from people who left. I… well anyone, really… could take control of them all in few minutes. this is totally out of our team's control and takes days to change. today someone without an account needed access for production support and I ended up telling them to take over the account of one of the leavers.
how bad am I?