Guide · File sharing

'Anyone with the link' is not access control

By Christopher Smith, MS Cyber Security, penetration tester·Published October 18, 2026·Updated October 18, 2026·5 min read

An 'anyone with the link' file can be opened by whoever receives that link — from a forwarded email, a chat history, or an old thread. You cannot see who has it, and you cannot take it back from one person. The Short says share by name instead; this guide shows the settings to change, the audit that finds old open links, and the order to close them in.

Quick verdict

• Share with named people by default. If a tool offers 'anyone with the link', treat it as public within anyone's inbox it reaches.
• Expire what you can. Where the plan supports link expirations and passwords, use them for genuinely external shares.
• Audit quarterly. Review link-shared files, close what is finished, and re-share by name what is still needed.

Why link sharing escapes your control

• Links are forwarded, pasted into tickets and chats, and kept in browser history — each copy works.
• There is usually no sign-in, so you get no useful record of who opened the file.
• Offboarding does not help: removing an employee does nothing to a link they sent outside. This is the file-sharing cousin of our personal Dropbox / shadow IT guide.

Safer sharing, step by step

1. Default to named sharing: invite specific people by their work account; give edit access only where the job needs it, otherwise comment or view.
2. Set an expiration for external shares where your Google Workspace, Microsoft 365, or Dropbox plan allows it.
3. Keep client and finance files in approved work storage with named accounts — not personal drives (see shadow IT guide).
4. Run the quarterly audit: in your drive's sharing / 'shared with' views and admin tools where available, list files shared by link, sort by sensitivity, and close or convert each one. Start with finance, HR, client data, and anything with credentials or IDs.
5. Replace, don't just close: if the work is still active, re-share the same file to the named people who still need it, then turn the open link off.

House rules worth writing down

• No client, payroll, or credential files on open links — ever.
• External collaborators get named accounts or expiring shares, owned by a staff sponsor, like contractor access.
• When someone leaves, their owned files transfer and their external shares are reviewed under the offboarding checklist.

Bottom line

Share with named people by default. If a tool offers 'anyone with the link', treat it as public within anyone's inbox it reaches. The expanded steps above turn the Short's rule into a process with an owner and a check — do the first section today, schedule the rest this week, and write down what you changed so the next person does not have to rediscover it.

Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.