The problem
Controls are bought in response to headlines, not business risk.
The risk
Identity, patching, backups and response planning gaps remain.
What good looks like
Rank controls by business impact, starting with identity, devices, data and recovery.
The outcome
Reduced exposure and a rehearsed response.