Cybersecurity: what to protect first, and with what budget

A two-hundred-person manufacturer commissions a security test. The report arrives with a hundred and forty findings ordered by technical severity: fourteen critical, thirty-one high and the rest between medium and low. Management asks the only question that report allows: how much does it cost to fix everything. The answer is a number nobody approves, the report is filed and the company stays the same, now with documented certainty that it is exposed.

The question management needed to be able to ask was a different one: which one gets handled on Monday. And severity does not answer it, because severity measures how bad it would be if someone exploited the flaw, not how likely it is that someone is exploiting it right now.

What changed this year

Verizon’s annual Data Breach Investigations Report, the DBIR, analyses real incidents rather than perception surveys. Its May 2026 edition brings a change of order: exploitation of software flaws, at 31% of cases, overtook credential theft for the first time as the way in (Verizon, DBIR 2026). The report attributes part of the shift to artificial intelligence shortening, from months to hours, the time between a flaw becoming known and someone using it.

The consequence is uncomfortable. For years the advice for a mid-sized company was to start with passwords and two-factor authentication. It is still necessary, and it is no longer first: if the window is measured in hours, the ability to install fixes quickly becomes the front line. That ability cannot be bought. It has to be organised.

The short list

A complete asset inventory takes months and is out of date before it is finished. What can be done in a week is the short list, and it comes from a single question: if this system is gone tomorrow, or its data has been altered, what stops working in the business and how many hours before it shows. Almost always, five to eight systems end up at the top, and the rest falls into order by itself.

That list is built with operations in the room, not only with technology. Technology knows which systems exist; operations knows which ones hurt. The difference between the two lists is usually the most useful finding of the exercise.

A public criterion for deciding what gets fixed first

The US Cybersecurity and Infrastructure Security Agency, CISA, publishes the Known Exploited Vulnerabilities catalogue, known across the industry as KEV. A flaw enters the catalogue when there is evidence that someone is exploiting it, not when it is theoretically serious. On 2 September 2026 it held 1,694 vulnerabilities from 283 vendors (CISA, KEV catalogue), a manageable number against the tens of thousands published every year.

The rule that follows is hard to argue with: first fix what appears in that catalogue and exists in your company, then everything else, by severity. According to the same DBIR, only 26% of the catalogue’s vulnerabilities had been fixed in the organisations analysed. It is the only figure in the report a company can act on this week without buying anything.

The other three doors

• Suppliers. Breaches involving a third party reached 48%. Four requirements fit in the contract at signing: a deadline for reporting an incident, the scope of access, what happens to access and data when the relationship ends, and whom the supplier depends on to provide the service.
• Credentials. Not every second factor holds up the same. A code the user can read aloud is a code someone can ask them for over the phone. Start with administrator accounts and the email of whoever signs.
• Artificial intelligence tools nobody approved. Their use tripled to 45% of the cases analysed. Banning them does not work. What works is saying which information does not leave the company, which tool is approved and whom to ask when in doubt.

Having backups is not being able to restore

Ransomware, the attack that encrypts a company’s data and demands payment to return it, was present in 48% of the breaches in the 2026 DBIR. Against it, restoring from a trustworthy backup is the main way to recover the operation without depending on the attacker. And a backup nobody has ever restored is a hypothesis, not a control: it may be connected to the same network that was encrypted, it may be incomplete, or the procedure may take three days instead of four hours.

The test costs an afternoon: restore one of the short-list systems in a separate environment and time it. That number is the only honest figure on the company’s ability to recover, and the best time to learn it is before the incident.

In security the winner is not whoever buys the most. It is whoever decided beforehand what cannot be allowed to stop first.