Five mistakes recur across organizations: not knowing what they own, patching exploited flaws too slowly, giving out broad access and weak sign-in, never testing backups, and having no practiced incident plan. Each has a cheap first fix, and public guidance from CISA and NIST agrees on the basics.
1. Not knowing what you own
You cannot protect or patch a system that is not on a list. Shadow cloud accounts, forgotten test servers and old devices become the unmonitored way in. NIST's Cybersecurity Framework 2.0 puts asset management under its Identify function for this reason.
Fix: keep one inventory with an owner per asset. Start with internet-facing systems, then add cloud accounts and the software each system runs.
2. Patching by calendar, not by exploitation
A monthly cycle treats every flaw alike. Attackers do not. CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities with evidence of active exploitation, and NIST SP 800-40 Revision 4 describes patching as preventive maintenance and recommends an enterprise strategy that prioritizes by risk.
Fix: put catalog matches on a short clock, such as days, and everything else on the normal cycle. Track the time from publication to fix for the first group.
3. Broad access and weak sign-in
Valid accounts are a standard way in. MITRE ATT&CK technique T1078, Valid Accounts, describes adversaries using legitimate credentials to gain access and persist, which also helps them blend in. Shared admin passwords, accounts of departed staff and no multi-factor authentication make it easy.
Fix: require multi-factor authentication everywhere, with phishing-resistant methods for administrators. Remove accounts on departure and review privileged access on a schedule.
4. Backups nobody has restored
A backup that has never been restored is a hope. CISA's ransomware guide stresses maintaining offline, encrypted backups and testing availability and integrity in a disaster recovery scenario. Attackers also look for backup systems and try to delete or encrypt them first.
Fix: keep at least one copy that an attacker with domain admin rights cannot reach, and do a timed restore of a real system every quarter. Record how long it took.
5. An incident plan that lives in a drawer
Decisions made during an incident are worse than decisions made ahead. NIST SP 800-61 Revision 3 places incident response within broader cybersecurity risk management: prepare, detect, respond and recover, then improve. Preparation includes knowing who decides to shut a system down and who talks to customers.
Fix: write a short plan with names and phone numbers, then run a two-hour tabletop twice a year.
What does this look like together?
A constructed example: a mid-size distributor has a file server exposed to the internet through an old remote access gateway. No one owns it because the manager who set it up left. A vulnerability in the gateway appears in the exploited list. The company has no inventory, so it learns about the gateway from a customer. Admin accounts have no second factor. The backups sit on a share the same admin account can reach. All five mistakes line up, and fixing any one earlier would have shrunk the damage.
Where can software help?
For mistakes one and two, a software inventory tied to vulnerability data shows which products contain a flawed component. Safeguard's SBOM and dependency scanning and reachability analysis cover the software side of that picture. They do not replace the organizational steps above.
How to check or apply this
- List internet-facing systems this week and name an owner for each.
- Compare your software and device versions with the CISA exploited list.
- Confirm multi-factor authentication on every admin and remote access path.
- Restore one backup, timed, and fix whatever fails.
- Hold a tabletop using the incident plan, and update it afterward.
Quick check
Which mistake should a small business fix first?
Multi-factor authentication on email, remote access and admin accounts. It is cheap and blocks a common path in.
Sources
- NIST Cybersecurity Framework 2.0
- CISA Known Exploited Vulnerabilities Catalog
- NIST SP 800-40 Rev. 4, Enterprise Patch Management
- MITRE ATT&CK T1078, Valid Accounts
- CISA, Stop Ransomware Guide
- NIST SP 800-61 Rev. 3
Last reviewed: 18 October 2026.
