Reduce the Likelihood

Discover and Harden

Inventory everything

every asset: cloud, on-prem, remote, unmanaged

Assess for vulnerabilities

authenticated, not just surface scans

Close unnecessary exposure

unused ports, software, dormant accounts

Close What's Left, Fast

Patch faster

automate the bulk; the patch window is shrinking

Virtual patch the rest

WAF / IPS / compensating controls for what you can't patch in time

Limit the Impact

Contain the Spread

Use microsegmentation to limit lateral movement, so a compromise can't move host to host.

When everything upstream fails, this decides whether it's an incident or a catastrophe.