Assume AI lowers the cost of reconnaissance and attack preparation

Prioritize phishing-resistant authentication for administrators, finance users, developers, and other high-impact accounts; monitor risky sign-ins and anomalous session behavior.

Continuously inventory internet-facing assets, exposed services, leaked credentials, and vulnerable software, then assign owners and deadlines for remediation.

Use detection rules for behavior rather than assumed attacker quality, including unusual mailbox access, mass reconnaissance, privilege changes, and abnormal data movement.

Automate low-risk triage and enrichment, but require human approval for containment actions that could disrupt critical users or systems.

Exercise incident response against a fast, personalized campaign and record how quickly the organization can identify, contain, communicate, and recover.