Prioritize identity, backups, updates and response preparation before buying complex security products.
Protect identities and administration
Require unique accounts, multifactor authentication and limited administrator access. Remove former staff promptly and avoid sharing passwords through messages or spreadsheets.
Make recovery credible
Keep protected backups, test restoration and document who can make decisions during an incident. Critical supplier and insurance contacts should be available even when normal systems are unavailable.
Reduce preventable exposure
Install updates, encrypt portable devices and teach staff how to report suspicious activity. A short, rehearsed process is more useful than an elaborate policy nobody follows.