Small organisations are not attacked by novel techniques. They are attacked by the same four routes, every time.
- —Phishing into an account without multi-factor authentication.
- —An unpatched device someone took home a year ago.
- —A shared admin login nobody has rotated.
- —A backup that has never been restored from.
Close those four and you have removed more risk than any dashboard you can buy.