Identity is the main battleground. Strong authentication and tight privileged access block many attack paths. Phishing-resistant MFA, separate admin accounts and managed service accounts make stolen credentials far less useful.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Use phishing-resistant MFA for admins
- Separate admin accounts from daily accounts
- Review service accounts and their rights
Next steps
Start with domain admins and cloud global admins. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.