If your company has sensitive data right now, here's some of what I'd do as a pre-2027 priority:
- Lockdown Mode for all devices (incl. phones)
- killing BYOD (phones) for roles with sensitive data access
- automating agent security patching pipeline (24x7, find, validate, remediate, deploy)
- instant page on stale builds + CVEs
- automated, same-hour cve patching on all services
- shutting down / sandboxing as many legacy services as possible
- lock down CI/CD: signed builds, pinned dependencies, no secrets in pipelines