More often than not, decision-makers are forced to work with modest cybersecurity budgets and prioritize their decisions. While there’s no such thing as an unwelcome cybersecurity measure, some are significantly more impactful than others.
The ranking below helps inform your priorities by ordering the measures to focus on. The higher a measure’s ranking, the more resources you should divert to its implementation.
Access Management and Identity Security
Stolen credentials are a chief entry point, so attacks continue to focus on their acquisition. Consequently, measures that strengthen credential security and access are vital. They also offer some of the greatest returns given the potential fallout they prevent.
The strongest measures start with unique credentials, preferably secured by passkeys or unique passwords generated by password managers. Credential security also needs to be augmented with multi-factor authentication. Meanwhile, access needs to be monitored, follow the least-privilege principle, and be enforced through Single-Sign-On.
AI Governance, Guardrails, and Usage Policies
Organizations need to implement AI governance and guardrails from the outset of adoption. This sets the ground rules for what data can be shared with AI tools and how to handle sensitive information. Enforcing those rules technically rather than on paper usually means routing model traffic through a secure AI gateway, which applies data-handling controls and logs every request centrally. It also preempts the proliferation of shadow AI, as employees are aware of approved tools and can submit proposals as new ones become available.
AI-related policies need to ensure human oversight and final evaluation of AI outputs. Additionally, employees should undergo training that equips them to identify and sidestep the growing number of AI-related threats.
Endpoint Protection and Device Management
Sophisticated network security measures are no substitute for secure and managed devices. Appropriate measures include the deployment of EDR solutions, device encryption, automatic patching enforcement, and BYOD policies if applicable.
Data Protection and Encrypted Communications
Identifying and safeguarding sensitive data significantly reduces the impact of potential cyberattacks. It needs to be classified and encrypted, with priority given to the most vulnerable data. Data Loss Prevention solutions should be considered if justified by scope and sensitivity.
Remote workers don’t benefit from centralized security measures yet need to securely access your networks. Mandating that they use VPNs significantly reduces the risk of monitoring and data theft, should they ever use unsecured public networks. It’s also an effective access measure since networks can be configured to only accept external connections if these come through vetted VPN IP addresses.
Backups and Incident Response Strategies
Applying as many security measures as budgeting permits yet always assuming that an attack may still happen is pragmatic. To that end, data backups and incident response planning are inexpensive yet effective steps that mitigate critical losses and let you resume normal operations more quickly.
A data backup is only reliable if it follows best practices like the 3-2-1 rule and is periodically tested. Similarly, actively maintained incident response plans ensure procedures are in place and employees can execute them with practiced competence.
Threat Awareness Training
Artificial intelligence has made existing threats like phishing and social engineering scams significantly harder to detect. Training remains important, but it has to adapt to the times. Shorter, more frequent sessions that mimic real-life scenarios are far more effective than annual sessions.
Training only goes so far if company culture is ambivalent toward or actively discourages best practices. The need for security awareness needs to come from the top down. Everyone in the organization should be encouraged to draw attention to suspicious messages and emails before they can become a true threat.
Network Security
Once a device is compromised, flat networks make it easy for attackers to move laterally and quickly infect more systems. Next-generation firewalls, network segmentation, DNS filtering, and comprehensive email security features form the backbone of a competent network defense.
Logging and Monitoring
Only known threats can elicit an effective response. A logging and monitoring system exposes internal and external threats more quickly. This allows for a coordinated, decisive response. Logging has to be centralized and come with alert prioritization so that attention can be focused on the most serious and immediate incidents.
Third-Party and Supply Chain Risk Assessment
Even when physical logistics aren’t involved, your company likely depends on a host of AI and cloud providers, SaaS platforms, or contractors. Supply chain attacks exploit unprepared third-party partners, so their cybersecurity standards have to match your own. Ensure this through vetting, security clauses when entering into partnerships, and continuous monitoring.
