Almost every cybersecurity guide for companies is the same list of ten things with no order to it, and the order is the only part that matters once budget and hours are finite. This one is ordered by what actually stops an attacker first, with what to check at each step so you know a measure is in place and not merely bought.
Ask what a company needs in order to protect itself and the usual answer is a list: antivirus, firewalls, backups, passwords, training, insurance, plans. Everything on the list is reasonable. The problem is that a list does not say where to start, and in practice people start with what is easy to buy instead of with what closes the path an attacker actually uses.
This article is ordered by something else: by how much each measure reduces risk relative to what it costs to put in place, in the order in which we see companies fall when we attack them with their permission. It is not an order of theoretical importance, it is the order in which the attacks that show up in the reports would stop working.
Most of the intrusions we see do not begin with an exploit: they begin with a valid credential. Somebody reused it, somebody typed it into a form that looked like the company’s, or somebody found it in a leak from another service. Which is why the first thing is not a product, it is identity.
Two measures, in this order. The first is multi-factor authentication on everything reachable from the internet, starting with email, the VPN and cloud administration. The second is least privilege: day-to-day accounts should not be administrators, and the ones that are should be used to administer and not to read email.
How you check it is in place, which is a different thing from having switched it on: ask for the list of accounts that can log in from outside without a second factor. If that list cannot be produced, you already have your first finding. If it comes out and it is not empty, those are the accounts people get in through. In Microsoft 365 this is exactly what a hardening engagement reviews.
The second step is patch management, with one nuance that changes the result: it is not about patching everything, it is about patching first whatever an attacker can reach without credentials.
And that is where the underlying problem appears, the one almost no company has solved: it does not fully know what it exposes. Subdomains left over from a campaign, an admin panel that was opened "just for a moment", a test environment with real data, a cloud service one team spun up and nobody wrote down. That is the attack surface, and you cannot protect what you do not know exists.
The honest check is to enumerate from the outside, the way an attacker would, instead of reading the internal inventory. That is exactly what an external penetration test does, and what it almost always finds is not an exotic vulnerability: it is a service nobody knew was still switched on.
Almost every company has backups. Far fewer have backups that survive ransomware, because the modern attacker goes looking for the backups before encrypting anything: that is what turns an annoying incident into a negotiation.
The three properties that make a backup useful on the worst day are that it sits outside the domain, so it cannot be deleted with the credentials the attacker has just stolen, that it is immutable for a period, and that somebody has actually restored from it at least once. The third is the one most often skipped and the only one that proves the other two.
The question that sums it up: if the attacker had your backup administrator’s credentials tomorrow, what would be left? If the answer is "nothing", the backup is just another file.
Social engineering is still the cheapest way in, and phishing its most common form. Here the usual measure, an annual course with a quiz at the end, changes nobody’s behaviour: it gets passed and forgotten.
What does move the needle is measuring with a controlled simulation and using the result for two different things. One is training, aimed at whatever the simulation showed was failing rather than at a generic syllabus. The other, and it is the one that gets forgotten, is measuring how many people report it. Somebody clicking is normal. Nobody raising the alarm is the finding.
And one rule of internal hygiene worth more than many courses: if your company sends internal emails that ask for credentials or push for urgency, you are training your staff to fall for it.
The four measures above reduce the probability of somebody getting in. Defence in depth starts from the assumption that one day somebody will, and concerns itself with making sure that getting into one place is not getting into all of them.
In practice that means segmenting the network so a compromised workstation does not reach the servers that matter, separating production environments from test ones, and watching endpoints with something that records what happens rather than only blocking what is already known. The aim is not to prevent the first step, it is to make the second one cost time and leave a trail.
Everything above can be bought, switched on and documented, and still not work. The difference between believing you are protected and knowing it is that somebody tried.
That is what a penetration test does: somebody with the same capabilities as an attacker attacks your systems with your permission, inside a signed scope, and tells you where they got in and in what order it is worth fixing. If you have never commissioned one, the two things to settle before anything is signed are exactly what you are asking for and where the legal line sits.
And the measure that closes the loop, because it is the only one that says whether the work was worth anything: checking the fixes again. A finding closed without re-verification is a finding you believe is closed. What matters in exposure management is not the list of vulnerabilities, it is how many were closed and how long they took.
Second factor and least privilege. Patch what faces the internet, knowing first what faces the internet. Backups the attacker cannot delete and that somebody has restored. Phishing simulation measured by reports and not only by clicks. Segmentation so that getting into one place is not getting into all of them. And checking it by attacking it.
None of the six is a product you buy once. All six are states that decay on their own if nobody measures them again.
What the secure development lifecycle is, what happens in each phase, what SAST, DAST and SCA add, and where to start if you have nothing in place today.
What risks generative AI brings into a company, why prompt injection is not the real problem, and what an AI pentest actually tests.
What a penetration test is, what phases it has, what you get at the end, how long it takes and how it differs from a vulnerability scan.
If any of this looks like a problem you are carrying, half an hour on a call scoping it with a senior pentester is worth more than reading another article.
Talk to a senior pentesterPick a time that suits you. You tell us what you need and where you are, and we explain how we work and how we can help.
