The breach you haven’t had yet is still preventable
Every year, organizations spend billions on next-generation security tools: threat detection platforms, threat intelligence feeds, zero-trust architectures. And every year, attackers walk right past all of it through an unlocked front door that nobody bothered to close.
I’ve spent years walking into organizations across health care, manufacturing, financial services, and government. The environments vary and the industry acronyms change, but the cybersecurity hygiene failures are remarkably consistent.
Here’s what I keep seeing and what you can do about it.
1. The first thing I check and why it’s almost always a problem
When I walk into a new engagement, my first move isn’t exotic. I ask for a list of active user accounts and compare it against current HR records.
Nine times out of ten, there are accounts that shouldn’t exist. Former employees whose access was never revoked. Contractors from a project that wrapped up eight months ago. Service accounts with no documented owner and permissions that have accumulated over years. In one engagement, we found a domain admin account tied to an IT director who had left the company nearly two years prior. The account was active, the password had never been rotated, and nobody knew it was there.
This kind of vulnerability doesn’t have a Common Vulnerability and Exposures (CVE) code associated with it and doesn’t require a sophisticated exploit chain; it’s already a wide-open direct path into the environment for anyone who finds it.
Identity hygiene is knowing who has access to what, and whether they should. It’s one of the most consistently neglected areas I encounter. Organizations invest in perimeter security, endpoint detection, and network monitoring, but they often haven’t done the basic work of auditing their own user directory. If you haven’t looked at your access lists lately, that’s where I’d start.
2. The uncomfortable truth about how most breaches really happen
The narrative around cybersecurity tends to skew toward sophistication. You hear about state-sponsored actors, zero-day exploits, or advanced persistent threats lurking in your environment for months before striking. Those are real threats, but they’re not what’s driving most of the incidents I respond to.
- Most breaches I see trace back to entirely preventable failures:
- Credentials compromised through phishing because multi-factor authentication wasn’t in place
- Ransomware deployed through a vulnerability that had a patch available for months
A threat actor who simply logged in using stolen credentials from a prior breach because employees were reusing passwords across platforms
The Verizon 2025 Data Breach Investigations Report shows that stolen credentials are the most common way attackers get in. They aren’t breaking in, they’re logging in. They’re taking advantage of gaps that don’t require any technical sophistication to exploit because the basics weren’t in place to stop them.
Organizations should acknowledge this as they think about investment. Chasing advanced threat detection before you’ve closed the elementary gaps is like installing a biometric lock on a door with a broken frame. Fundamentals like patching, MFA, endpoint protection, and access controls aren’t glamorous, but they eliminate the most commonly targeted attack surfaces.
3. Three questions every business leader should ask their IT team today
To get a quick read on your organization’s hygiene posture, ask your IT team these three questions. Pay attention not just to the answers, but to how quickly and confidently they’re delivered.
- When did we last audit who has access to our critical systems, and can you show me the results? If the answer is vague, or if it takes days to produce a list, that’s a signal. Access governance isn’t a one-time exercise. It should be a regular, documented process. If your team can’t tell you clearly who has privileged access and why, that’s a gap that must be addressed.
- What’s our current patch lag for critical vulnerabilities? How long does it take from the time a critical vulnerability is published to when it is remediated in your environment? If the honest answer is “weeks” or “it depends,” you’re carrying risks you haven’t quantified.
- When did we last test the accuracy and viability of our backups? Backup policies almost always exist in every organization I visit. Verified, tested recovery capabilities are far less common. In a ransomware scenario, the difference between a manageable recovery and a catastrophic one often comes down to whether anyone had actually validated that the backups work. If the last time someone tested a full restore was over a year ago, or if the answer is uncertain, that conversation needs to happen soon.
4. What good hygiene looks like at a mid-sized organization
For a company in the 150–500 employee range, cybersecurity hygiene requires building consistent, sustainable practices across a handful of critical domains.
In practice, genuinely well-postured organizations share a few common characteristics.
- They enforce multi-factor authentication across all remote access and critical applications; not just email, but everything.
- They maintain a patching cadence that treats critical vulnerabilities with urgency rather than fitting them into a monthly maintenance window.
- They track all endpoints in their environment and have standardized protection deployed and monitored across each.
- They have a documented, tested incident response plan the team has walked through, not just written down.
- They review user permissions at least annually, with someone accountable for confirming access still reflects current roles and employment status.
None of this requires a massive security budget or a team of twenty. It requires ownership, process discipline, and leadership that treats these practices as operational necessities rather than IT nuisances. The organizations that struggle most with hygiene usually aren’t short on resources. Security just hasn’t been assigned clear ownership, and nobody is accountable when the basics slip.
5. How to prioritize when you’re already stretched thin
When resources are constrained, the instinct is to either defer everything or try to do everything at once. Neither approach gives the outcomes leaders are seeking, and this is the conversation I have with leadership teams most often.
Not every security investment carries equal weight. Some controls address your most likely risks; others address risks that are real but of a lower probability for your specific environment. For most mid-sized organizations, MFA, patch management, and tested backups should come before a threat intelligence feed or a security awareness training platform.
I also push leadership teams to think about hygiene investments in terms of scenarios they would have to explain to a board, a regulator, or a client. If your organization experienced a ransomware incident tomorrow and the root cause turned out to be an unpatched vulnerability or a lack of MFA, what would that conversation look like? That framing quickly clarifies priorities.
Conclusion
Cybersecurity doesn’t have to be perfect to be significantly better. Most attackers are looking for the easiest target, not the hardest one. Closing the basic gaps removes your easiest targets. For most organizations, that’s entirely achievable with focused, intentional effort rather than a complete security overhaul.
Ready to close the gaps that make your organization an easy target?
About the author
John Otte
Senior Manager, Cybersecurity Consulting @ Resultant
