Ten ways to secure your organization, ranked by the evidence

Most security advice for mid-sized companies is really a shopping list. This one isn't. Every number below links to the report it came from, so you can check us.

We wrote it for a company of 100 to 500 people with a small IT team, a Microsoft or Google tenant, and somewhere between twenty and a hundred apps. If that's roughly you, the order should feel about right.

One caveat before the list. Nobody ranks security controls objectively, and anyone who says they can is selling something. We used two rough tests: how often the failure actually turns up in breach reports, and whether a small team can do something about it this quarter without asking for money.

That second test is why encryption at rest and network segmentation aren't here. Both matter. But at this size they're usually either on by default already or a six-month project, and neither one gives you anything to do on Monday.

Identity is how they get in. Not the firewall, not the laptop, not some clever zero-day — an account that should have stopped working and didn't.

Sophos asked 2,158 IT and security people at companies between 100 and 5,000 employees about their ransomware incident. In State of Ransomware 2026, 79% of attacks started from a compromised identity, and two thirds of victims said the ransomware incident was also the worst identity attack they'd had. Same event, described twice.

Here's why that puts it at the top instead of buried under “ransomware”: it's the one way in that your own paperwork creates. Nobody decides to leave a departed employee's Dropbox running. It happens because the person had accounts in 34 systems, IT heard about eleven, and the list covering the rest lives in somebody's head.

The credential problem underneath it is worse than most people assume. SpyCloud, which feeds recaptured-credential data into the 2026 Verizon DBIR, counted 5.3 billion credential pairs circulating in criminal markets, and roughly four in ten corporate users have reused a password that shows up in one of those dumps. So an account still alive after someone leaves is, statistically, an account whose password is already for sale.

Why it's harder than it sounds

The usual answer is “just use SCIM” — the standard that lets your directory create and delete users in other apps automatically. Great idea. Mostly you can't.

The SCIM Tax Index, an open dataset of about 300 SaaS vendors updated in April 2026, found 89% of them lock SCIM behind an Enterprise plan or a “contact sales” conversation. Twelve include it on every tier. Twelve, out of three hundred. (It's published by Iden, who compete with us. The data is good and it's openly licensed, so we're citing it anyway.)

Which means Entra ID and Okta will happily provision the apps that speak SCIM — somewhere around a fifth to a quarter of what you run — and a person with a browser does the rest. Unlocking it isn't cheap, either. Atlassian Guard is an add-on that buys you nothing except identity management. Shopify goes from $29 a month to $2,300 for the tier that includes provisioning.

Where we fit, and where we don't

This is the bit we sell, so here's the actual argument instead of a slogan.

We don't replace your directory. Entra or Google Workspace stays exactly where it is and we write to it. Good SSO coverage makes you a better fit for us, not a worse one, because we need somewhere authoritative to fan out from. If you have no identity provider at all, go fix that first — we'll tell you so.

We cover what SCIM can't reach. Entra ID Governance and Okta Lifecycle Management automate the apps that speak SCIM. So do we, and then we keep going into the ones that never built it or want four figures a month to switch it on. That leftover pile is what your team still does by hand, which is the part worth automating. People reach for Entra ID P1 at $6 a user as the comparison, but P1 on its own doesn't do lifecycle governance — that's P1 plus the Governance add-on, and even then it only reaches the SCIM share.

Every connector runs on a documented API. Some competitors close the coverage gap by driving vendor admin pages with a headless browser. It works, it covers far more apps than we will, and it breaks the week the vendor redesigns a page. We took the other trade on purpose: fewer integrations, each one built on something the vendor documents and supports. If an app has no supported way in, we tell you it's manual rather than automating it in a way that can quietly stop working.

Failures are loud. The worst thing software like this can do is fail silently on a removal, because then you think somebody was offboarded and they weren't. Failed jobs show up in the app with the reason attached, and you get an email. A visible failure is a five-minute problem. A silent one is what you read about thirteen months later.

We only touch what we manage. Your tenant is full of things we didn't create — service accounts, app registrations, guests, break-glass admins, shared mailboxes. We read those and report on them, and never modify them. New tenants also start in report-only mode: the sync runs, logs everything it would have done, and you read that log before we're allowed to write anything.

And the thing an auditor actually asks for. Your directory can prove what happened inside your directory. The question is “show me this person lost access to all 43 systems on their termination date,” and no single-vendor tool answers that for the apps outside its own ecosystem. That report is the one thing here Microsoft structurally can't produce.

Our connector roadmap is public, in build order, including the apps we can't reach at any price and why.

MFA is the best deal in security and it isn't close. Microsoft measured its own Entra ID population and found a 99.22% drop in account-compromise risk — 98.56% even for accounts whose passwords had already leaked.

The catch is that “MFA” covers everything from a texted code to a hardware key, and attackers spent years learning to beat the weak end. CISA's guidance is blunt about it: only FIDO/WebAuthn and PKI actually count as phishing-resistant. SMS codes lose to SIM swapping and SS7 interception. Push approvals lose to prompt bombing — send enough notifications at 2am and somebody taps approve just to make it stop.

This one moved up recently and it's worth noticing. In the 2026 DBIR, exploiting a vulnerability accounted for 31% of breaches, passing credential abuse, which fell to 13%. Edge kit takes a wildly disproportionate share — VPN boxes, firewalls, file-transfer appliances — because they're internet-facing by definition and usually owned by nobody in particular.

The same report puts median time-to-remediate at 43 days, and found only 26% of the vulnerabilities in CISA's Known Exploited Vulnerabilities catalogue got fully fixed during the year. That's the real gap. Not that people don't know about patching — that patching everything is impossible, most teams have no rule for what goes first, and the queue gets worked in whatever order the scanner printed it.

Backups decide whether ransomware is a bad fortnight or the end of the company, and the good news in the Sophos data is real: recovery from backup reached 66% of cases where data got encrypted, up twelve points in a year. The bad news sits right next to it. Average recovery still cost $1.7 million, up 11%, and 48% of encrypted victims paid anyway.

Modern ransomware assumes you have backups. CISA's guidance spells out the playbook: delete the snapshots, encrypt the repository, kill the backup agent, then walk into the cloud backups using the credentials they already stole from the admin who set them up. A backup you can reach with production credentials isn't really a backup.

Business email compromise is the quietest expensive thing that happens to companies this size. The FBI's 2025 Internet Crime Report logged $3.05 billion in BEC losses across 24,768 complaints — north of $122,000 each on average — with 86% of the money leaving by wire or ACH. There's no malware in this attack. There's an invoice with new bank details and an email that reads fine.

If item one is about which door opens, this is about how far they walk. What attackers want isn't just any account. It's one with permanent admin rights, used for everyday work, signed into a laptop that also reads email.

It's also the cheapest item here, because for most companies it's configuration rather than a purchase. Separate admin accounts, no email or browsing on them, and elevation you get for an hour instead of forever.

The 2026 DBIR put third parties in 48% of breaches, with supply-chain incidents up 60% year over year. At this size that's rarely some abstract compromised-software-vendor scenario. It's the marketing contractor with a permanent admin login, the MSP account nobody rotates, and the OAuth grant somebody approved for a tool that reads the entire mailbox.

M-Trends 2026, built from over 500,000 hours of incident response, puts global median dwell time at 14 days. The interesting bit is the split: companies that caught it themselves ran a median of 10 days, while the ones who found out from an outsider ran 26.

The money follows the same shape. IBM's 2026 Cost of a Data Breach found breaches that took longer than 200 days to identify and contain averaged $5.65 million, against $4.32 million for the faster ones. Detection speed isn't a nice-to-have. After the breach starts, it's the biggest variable you still control.

The human element showed up in 62% of breaches in the 2026 DBIR, up from 60%. The more useful finding, if you run awareness training, is where this is heading: mobile-based phishing simulations pulled engagement rates 40% higher than email ones. Attackers are moving to SMS, messaging apps and voice — channels your email security stack cannot see at all.

Annual compliance training does nothing about that, and neither does making people feel stupid for clicking. The number to chase isn't a lower click rate. It's a shorter time-to-report, because a click reported in four minutes is a contained incident.

IBM put the global average breach cost at $4.99 million in 2026, with the US average at $11.5 million, and found companies took an average of 247 days to identify and contain one — undoing several years of slow improvement.

A company your size is never going to have a real incident response function, and doesn't need one. What it needs is a page answering the questions nobody can research at 3am: who decides, who calls the insurer, who calls the lawyer, who talks to customers, and what the first three technical steps are. Most of the value is in writing it, because writing it is what surfaces the fact that nobody knows the cyber insurance policy number.

If you only do three of these

Nobody works through a ten-item list. If this quarter has room for three, we'd pick: phishing-resistant MFA for every admin, one tested restore, and a written offboarding list with a clock against it. Those cover how they get in, how far they get, and how you come back, and none of them needs a purchase order.

And if you counted the gap in item one and the answer turned out to be thirty-odd apps that a person closes by hand — that's the conversation we're useful for. Fifteen minutes, no deck, and we'll tell you if it isn't worth your time.

Sources

Every number above comes from one of these. Where a report sits behind a registration form, we've linked the publisher's own summary rather than somebody else's write-up of it.