Most breaches we see at client companies don't come from a sophisticated attack. They come from an ex-employee's account nobody deactivated, or a laptop with no disk encryption left in a taxi. This is the list we run through with every client before touching anything more advanced.
1. Lock down access first
Before any other control, know exactly who has access to what — and make removing that access on someone's last day a checklist item, not a task that waits for "when we get to it." We've inherited three separate incidents this year that traced back to a contractor's login still active six months after the contract ended.
- Single sign-on for every tool that supports it
- A shared, current list of who has access to what
- Offboarding as a same-day checklist, not a follow-up task
2. Cover the devices, not just the network
A firewall doesn't help once a laptop leaves the office. Disk encryption and remote-wipe capability on every company device closes the gap that a stolen or lost laptop opens — and it's a setting, not a project.
The most expensive incidents we've cleaned up all started with a device, not a network.
3. Test your backups, not just take them
A backup nobody has restored from is a belief, not a plan. Pick a quarterly date and actually restore a file from backup to confirm the process works end to end.
4. Know what your vendors can see
Every integration you connect is a door into your data. Keep a short list of what each connected tool can access, and review it whenever you add or drop a vendor.
Quick self-check
- Can you list every tool with access to customer data, from memory, right now?
- Did your last ex-employee's access get removed the same day they left?
- Has anyone actually restored a file from your backups this year?
5. Train for the phishing email, not the exam
Annual compliance training rarely changes behavior. A short, realistic phishing simulation twice a year teaches people what the actual email looks like in their inbox — which is the version that matters.
6. Put someone on watch
Alerts nobody reads aren't a control. Whether it's an internal owner or an outside provider, someone needs to be accountable for actually looking at what the monitoring tools flag.
7. Write the incident plan before you need it
A one-page plan — who to call, what to shut down first, how to communicate with customers — turns a chaotic first hour into a manageable one. Write it when you're calm, not during the incident.
None of this is exotic. It's the difference between the fifteen incidents we've helped clean up and the ones that never happened to clients who did this work first.
Chidinma Obi leads security engagements at Alod Technologies and has run incident response for clients across fintech and healthcare.
