What Cybersecurity Improvement Should Businesses Make?

October’s Cybersecurity Awareness Month is a reminder that improving cyber resilience doesn't always require a complete overhaul of technology or significant new investments. In many cases, meaningful progress comes from focusing on the controls, processes, and practices that can have the greatest impact on reducing risk, so you can move forward with confidence.

To better understand where organizations should focus their efforts, we asked four cyber professionals the same question:

If you could convince every business to make one cybersecurity improvement this year, what would it be and why?

Their answers offer practical guidance on strengthening defenses, reducing exposure, and improving resilience in today's evolving threat landscape.

Create a Process for Verifying Sensitive Requests

Michael Spinks, CFC, Head of SME Cyber, US

As AI-generated communications become increasingly sophisticated, Michael Spinks believes businesses should focus on strengthening verification processes.

"Encourage businesses to implement mandatory verifications through separate communication channels for financial transactions above a certain size, account changes, or sensitive requests.

Although the technology is still important, AI is rapidly challenging our ability to verify information online. Processes whereby employees verify requests through a secondary communication channel would have helped prevent some of the more sizeable losses we have seen.

Although a relatively basic control, it would work regardless of company size, technology budget, or industry, yet would still be a powerful and effective means of mitigation."

As cybercriminals become more effective at impersonation and social engineering, independent verification procedures can provide an important safeguard against fraudulent requests.

Strengthen Identity and Access Management

William Altman, CyberCube, Director of Cyber Threat Intelligence Services

For William Altman, one of the most effective cybersecurity improvements remains strong identity and access management.

"Strengthen your identity and access management practices by enforcing multi-factor authentication universally, adopting least-privilege access, and auditing privileges regularly.

This is good hygiene, and it's also directly relevant to AI-driven threats since AI has mostly accelerated the same playbooks, like phishing, credential theft , and social engineering, giving them more volume and reach rather than introducing fundamentally new techniques.

Strong identity controls blunt the AI-accelerated speed advantage because even a highly convincing, AI-generated lure fails if authentication and access boundaries hold. It's a control that pays off against both today's attacks and tomorrow's."

While cybersecurity discussions often focus on emerging threats, effective identity controls continue to serve as one of the most reliable layers of defense.

Focus on the Risks Most Likely to Cause Loss

Matt Massino, Coalition, Inc., Business Development Team Lead - North East

Rather than adding more tools, Matt Massino recommends focusing on the controls that address the most significant business risks.

"Start with the basics: protect email and remote access systems , promptly address critical vulnerabilities, require multi-factor authentication, and regularly test backups and incident response plans.

The goal is not to just buy more tools. Businesses should focus their limited time and budget on the issues most likely to cause material losses.

Establishing a simple, prioritized cyber risk improvement plan based on what attackers can exploit is crucial to avoiding incidents."

Cybersecurity resources are often limited. Prioritizing the vulnerabilities and exposures most likely to impact the business can help organizations make meaningful improvements without becoming overwhelmed.

Reduce Unnecessary Data Retention

Carolyn Purwin Ryan, Mullen Coughlin LLC, Partner

When asked what improvement businesses should make, Carolyn Purwin Ryan points to an area that is often overlooked: data minimization.

"In the immortal words of a smart woman, 'Let It Go.' Get rid of your stuff. If I could make one change, it would be aggressive data minimization.

Businesses hold onto far too much data for far too long, often without knowing why they still have it. Every unnecessary record you keep is another record that can be stolen, require notification, and increase litigation exposure.

Have a real protocol: know what you have, why you need it, shorten retention periods where you can, and actually delete it. The rule is simple: If you don't have it, they can't steal it, and I don't have to defend you for losing it."

Reducing unnecessary data can not only limit the amount of information available to attackers but also reduce the operational and legal challenges that may follow a cyber incident.

Looking Ahead

Although each expert offered a different recommendation, a common theme emerged: effective cybersecurity does not have to be complicated. Often the most impactful improvements are practical, repeatable measures that strengthen how businesses manage access, verify information, prioritize risk, and protect sensitive data.

Organizations that focus on meaningful improvements and strong fundamentals are often better positioned to adapt as threats evolve. Working with a trusted advisor can help you evaluate your cyber risks, align cybersecurity and cyber insurance strategies, and make informed decisions that support your business today and into the future. And by taking a proactive approach to risk management, businesses can move forward with confidence.