Most breaches exploit basics, not exotic zero-days. If you only have budget for five things, start here.
1. Phishing-resistant MFA everywhere
Passwords leak. Enforce multi-factor authentication on email, VPN, cloud consoles and every admin account, and prefer FIDO2 or passkeys over SMS codes.
2. Patch internet-facing systems fast
Track every exposed system and set a clear deadline for critical fixes. Attackers scan for new vulnerabilities within hours.
3. Least privilege and separate admin accounts
Day-to-day accounts should never be administrators. Review privileged access quarterly.
4. Tested, immutable backups
Backups that cannot be altered and have been restored in a drill are your best answer to ransomware.
5. Centralised logging with someone watching
Logs nobody reads do not help. Decide who triages alerts, how fast, and what they do next.
These five controls do not replace a full programme, but they close the doors attackers use most often.