Cyberattacks that most often hurt organizations are usually not new or glamorous. Instead, they are routine failures of basics that defenders already know how to prevent.
Damon Becknel, vice president and deputy CISO for regulated industries at Microsoft, advocates that relentlessly executing on four priorities is key to raising the bar against attackers looking for cheap and easy wins. Here are the four:
- Deliver on essential cyber hygiene practices.
- Use modern security standards and protocols.
- Ensure stronger actor identification through fingerprinting.
- Coordinate better collaboration and learning across your ecosystem.
Cyber Hygiene
On cyber hygiene, Becknel emphasizes disciplined asset inventory, internal segmentation that blocks workstation-to-workstation lateral movement, tighter exposure controls for public systems (including blocking known bad IP space), and logging that is deep enough and retained long enough to support detection engineering and incident response.
He calls out identity hardening as foundational, with phishing-resistant MFA such as passkeys and hardware keys, and he pairs that with timely patching, EDR, full-disk encryption, host firewalls, and practical controls that reduce the two biggest initial access paths — web and email — via proxies and secure email gateways.
Becknel also frames DLP as a logical next step once the basics are stable.
Modern Standards
Where many programs stall is over legacy. Becknel urges organizations to retire weak protocols and dependencies, including insecure DNS, misconfigured SMTP, and Exchange Web Services in favor of Microsoft Graph, and to enforce DMARC blocking to reduce spoofing.
Identity
He recommends device, browser, network and user fingerprinting because IP-based blocking alone no longer distinguishes real users from hijacked accounts and proxy traffic.
The broader best practice context is consistent with CIS Controls asset inventory, CISA’s KEV-driven patch prioritization, and NIST zero trust principles, all of which map cleanly to how security teams justify and buy integrated identity, endpoint, email, network, and telemetry platforms.
Collaboration
Becknel encourages companies and those in the IT community to talk more openly about threats. “Sharing intelligence allows organizations to provide real-time updates on emerging cyberthreats, indicators of compromise, and malicious activities. In return, they also gain similar insights, enhancing their detection capabilities,” he wrote in his December blog.
Now is the time to take action.
In an era where attackers continue to exploit the simplest cracks in the armor, executing the fundamentals with rigor is no longer optional — it’s a competitive and operational necessity.
As Becknel makes clear, elevating your cybersecurity posture doesn’t start with chasing the newest shiny tools. It starts with mastering the basics, modernizing what’s outdated, strengthening identity at every layer, and building a culture where collaboration isn’t an afterthought but a core security strategy.
Organizations that commit to these foundational priorities don’t just reduce risk — they increase resilience, improve response readiness, and strengthen trust with customers and partners alike.
If your security strategy needs a reset, refinement, or a roadmap grounded in proven best practices, start by assessing where your organization stands against these four pillars. Engage your teams, challenge your assumptions, and initiate conversations across your ecosystem.