You do not need a security department to be hard to hack. In our incident-response work, the same five missing basics show up again and again — and each one is fixable in an afternoon.
1. Turn on multi-factor authentication everywhere
Stolen passwords drive the majority of breaches we investigate. Enforce MFA on email, cloud admin consoles and code repositories first; authenticator apps beat SMS codes. This single control blocks more attacks than everything else on this list combined.
2. Patch on a schedule, not on a scare
Attackers scan for known vulnerabilities within days of disclosure. A monthly patch window for workstations and an automated pipeline for servers closes the gap. If a vendor ends support for something you run, that is your migration deadline.
Backups you have never restored are hopes, not backups. Test a full restore every quarter.
3. Back up like recovery is the product
Follow the 3-2-1 rule: three copies, two media types, one off-site and offline. Ransomware cannot encrypt what it cannot reach, and a tested restore turns a crisis into a bad morning.
4. Give people the least access they need
Review who can reach financial systems, customer data and production infrastructure every quarter. Remove dormant accounts the day someone leaves. Most insider incidents are accidents enabled by excess permission.
5. Train against phishing, then test
Short, role-based sessions plus simulated phishing emails cut click rates dramatically within two quarters. Celebrate reporters — the employee who flags a phish is your best sensor.
Need help working through the list? Our security assessments score all five in 14 days with a fix-first report.
Ethan Miller
CTO at Nimbusforge Labs. Runs our security practice and has led 200+ assessments.