Cybersecurity Checklist 2026: 12 actions to protect your company

To improve cybersecurity in 2026, your company should prioritize 12 actions across four fronts: protecting identities and access, detecting and blocking threats, ensuring tested backups and a response plan, and preparing people and suppliers. Start with phishing-resistant MFA, EDR, tested immutable backups, and 24/7 monitoring.

Why does cybersecurity need attention now?

October is International Cybersecurity Awareness Month, and the context of 2026 calls for a review of defenses. A Sophos report with IT and security leaders in Brazil shows that email remains the most common entry point, but the root cause of most attacks is compromised identity. The global research also indicated that, for the first time in four years, exploited vulnerabilities are no longer the primary root cause, with malicious emails (26%) and phishing (24%) now leading the way. 

The cost also shifted: the median ransom payment was US$769,000, but the average recovery cost reached US$1.7 million per incident. In other words, the biggest loss is in the operational shutdown, not the ransom. 

What are the 12 cybersecurity actions for 2026?

1. Adopt phishing-resistant MFA for all critical access points

Cover email, ERP, VPN, cloud consoles, and administrative accounts. Prefer security keys (FIDO2) or applications with number-based approval over SMS. Also review session lifetimes, because MFA alone does not prevent session hijacking.

How to validate: no administrative account accesses systems without MFA, and SMS is no longer the primary method.

2. Apply the principle of least privilege

Review quarterly who has access to what, remove accounts belonging to former employees and third parties, and separate the daily use account from the administrator account.

How to validate: an updated list of privileged accounts with no orphaned accounts.

3. Adopt the Zero Trust logic

Don't trust anyone by default, not even within the network. Verify each access point and segment the network to prevent lateral movement if an intruder gets in. At Skyone, Autosky already operates with Zero Trust, mandatory MFA, and a dedicated virtual network per client.

How to validate: compromising a workstation does not grant direct access to the servers.

4. Maintain a vulnerability management cycle

Map assets and prioritize remediation based on real business impact, not just technical notes. Threat analysis continuously assesses the attack surface.

How to validate: critical vulnerabilities in exposed assets remediated within a defined timeframe.

5. Install EDR on all endpoints and servers

Traditional antivirus software doesn't cover modern attacks like fileless attacks. EDR continuously monitors and responds to malicious activity. See how the Nortis Group protected its infrastructure against ransomware with EDR.

How to validate: 100% of servers and workstations have an active agent and alerts are being handled.

6. Monitor the environment 24/7

Attacks happen outside of business hours. A SOC/SIEM collects and correlates events from across the infrastructure and dispatches specialists to contain the incident.

How to validate: someone responds to a critical alert at 3 AM on a Saturday.

7. Protect what is exposed to the internet

Inventory your published websites, APIs, and remote access points. Use firewalls and WAFs to block common web attacks (OWASP Top 10), bots, and malicious scripts.

How to validate: maintain an updated list of exposed assets, each with defined protection.

8. Have an immutable, replicated, and tested backup

The 3-2-1 rule still applies: three copies, two media, one off-site. Immutability prevents an attacker from deleting the copies. Test the restoration, because a backup that's never been tested is a gamble. In Sophos' research in Brazil, 98% of companies with encrypted data managed to recover it, mostly via backup and not through payment. Skyone's advanced backup is automated and immutable.

How to validate: a real restoration performed within the last 90 days, with measured time.

9. Write and rehearse an incident response plan

Define who decides what, who communicates with clients and the ANPD (Brazilian National Data Protection Authority), which systems come back online first (RTO and RPO), and what the ransom payment policy is. Conduct a desk exercise once a semester.

How to validate: the plan fits in a few pages and everyone involved knows where it stands.

10. Train people with real-life simulations

Annual slide training doesn't change behavior. Periodic phishing simulations measure real risk and strengthen security culture. Phishing testing does this job.

How to validate: click-through rate and reporting rate monitored month by month.

11. Perform periodic penetration tests (pentests)

Run at least one penetration test per year and after significant changes to the architecture. The penetration test simulates controlled attacks to find critical vulnerabilities before the criminals do.

How to validate: report with prioritized findings and follow-up corrections until closure.

12. Govern personal data, suppliers, and AI usage

Maintain an inventory of personal data (LGPD compliance), assess the security of vendors accessing your environment, and define rules for AI tools, preventing shadow AI(the use of AI without IT approval).

How to validate: publish an AI policy and evaluate critical vendors.

Where to start: 30, 60 and 90 day plans

Frequently Asked Questions

What's the first thing to do to improve a company's cybersecurity?

Protect identities: enable MFA on administrative accounts, email, and ERP systems, and review accounts and permissions. Data shows that most attacks begin with compromised identities.

I have MFA. Am I protected?

Not entirely. In 97% of compromised credential incidents in Sophos research, some level of MFA was already in place. Use phishing-resistant methods and monitor sessions and unusual behavior. 

Is antivirus enough in 2026?

No. Traditional antivirus doesn't effectively detect modern attacks like ransomware and fileless attacks. EDR monitors behavior and responds automatically, working alongside the tools you already have.

Do small and medium-sized businesses need a SOC?

If there is sensitive data, continuous operation, or LGPD (Brazilian General Data Protection Law) requirements, then yes. SOC as a service provides 24/7 monitoring without the need to assemble your own team.

Does paying the ransom solve the problem?

There's no guarantee. The cost of recovery usually exceeds the ransom (average of US$1.7 million versus a median of US$769,000), and the decision to pay has become a matter of governance. A tested backup reduces dependence on this choice. 

Speak with a specialist to assess your company's maturity level using this checklist

Written by Skyone