Most breaches follow a few familiar patterns. Misdirected email, lost devices, wrong access rights and phishing make up a large share.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Misdirected email: ask the recipient to delete it and confirm
- Lost device: check encryption and wipe remotely
- Wrong access: remove it and check the logs
Next steps
Short playbooks for each scenario speed up decisions. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.