Most people will say no, but I think if you add some constraints it gets a lot easier. Things like MFA and a zero trust approach are extremely effective against attackers. If you have the ability to start early and get that sort of approach in place you're going to be one of the harder targets out there.

There's obviously way more to it than that, but a huge problem today is that once an attacker gets into a network they can hop around as they please due to implicit trust. Removing that implicit trust and checkpointing access via u2f are huge barriers.

It's also not super hard imo to gradually move to.