People always talk about how asymmetrical the attack surface is, and I don't disagree with this in principle. However, most companies don't do a lot of the basics: Segment networks, keeps applications and software up to date, keep admin or management interfaces unavailable.

The biggest step that I think most companies could benefit from without drastically increasing their cybersecurity spending would simply be to attempt to deploy and use less software and fewer services. Each new piece of software is just waiting to be exploited, waiting to be out of date and forgotten. It'll become part of someone's "necessary" workflow, but it will never be important enough that it's simply kept up to date and managed well. If that software were never there in the first place, the business would simply use some other workflow process, and there would be nothing to be forgotten and exploited.