Web Access Management gives security teams a policy mechanism for what users download and from where, plus a full audit trail of every decision and action.
Over-provisioning at onboarding and accounts that outlive the contract are two failures temporary staff create. Both leave privileged access open to attackers.
Living off the land hides inside trusted binaries no scanner flags as bad. Removing standing local admin rights shrinks what an abused tool can reach.