Most attacks start with a phishing email, an unpatched remote service or credentials bought from a previous breach. Remote access gateways, VPNs and exposed admin panels are common targets. Stolen passwords without MFA are often enough.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- List every service reachable from the internet
- Require MFA on all remote access
- Watch for leaked company credentials
Next steps
Closing exposed services is often the fastest risk reduction available. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.