You're the security team now. Start here.
Maybe you inherited security along with IT. Maybe a customer questionnaire or a cyber insurance renewal forced the issue. Either way, you're now responsible for security at an organization that has never had a security program, and every vendor on the internet wants to sell you the answer.
Here's the thing the vendors won't tell you: your first problem isn't a tooling problem. It's a prioritization problem. The entire field of security is engineered to feel infinite — endless threats, endless frameworks, endless products — and if you treat it as infinite, you'll spread one person's attention across a hundred controls and do none of them well. The way out is a very old idea.
Security has a Pareto distribution
The Pareto principle — the 80/20 rule — says that in most systems, a small minority of causes produces a large majority of effects. Security at small organizations is one of the strongest Pareto distributions you will ever see: a handful of weaknesses account for almost all real-world breaches, and a handful of controls close them.
This isn't a slogan; the breach data says it plainly. Verizon's 2026 Data Breach Investigations Report — the largest annual study of confirmed breaches — found that small organizations made up 96% of ransomware victims, and ransomware appeared in nearly half of all breaches studied. And the attacks weren't exotic: among opportunistic attacks, 38% of victims had compromised credentials and 29% had unpatched internet-facing devices. Two doors, two-thirds of the carnage. Add compromised email for payment fraud, and you've described nearly the entire SMB threat landscape.
The same report carries the good news, which is the entire thesis of this site: 69% of small organizations hit by ransomware refused to pay — because their backups held. One control, properly operated, converted a company-ending event into a bad week.
So the vocabulary for everything that follows, borrowed from Joseph Juran, who named the Pareto principle: the vital few — the small set of controls that eliminate most of your breach probability — and the trivial many — everything else, which is not worthless, but which must wait. Your job in year one is to identify the vital few, deploy them completely, and defend your attention against the trivial many.
The 80/20 rule cuts both ways. It promises that a focused program beats a sprawling one — and it warns that doing twenty controls at 40% coverage delivers almost nothing. A Pareto strategy only works at full coverage of the few. Half-done MFA is a locked front door next to an open window.
First, find your 20%: two lists
You can't apply the 80/20 rule to an environment you can't see. Before anything else, build two inventories:
- What we have. Every device, server, SaaS app, and data store that matters. Don't aim for perfect — aim for "nothing important is missing." A spreadsheet is fine.
- Who can touch it. Every account with admin rights, every shared password, every third party with access. This list is always longer than expected, and that's the point.
You can't protect what you can't see. Half of what looks like a security problem at small organizations is an asset and access problem wearing a costume — and most of what's dangerous is dangerous precisely because it's invisible: the forgotten admin account, the backup job nobody watches, the server everyone assumes someone else owns. The two lists are the act of dragging all of it into the light — and they're what tell you where your particular 20% lives. The vital few below hold for nearly every small organization, but your inventories are how you confirm it for yours.
The vital few: five controls that close the real doors
Small organizations don't get breached by nation-state exotica. They get breached through stolen credentials, compromised email, and unpatched internet-facing systems. Ransomware almost always arrives through one of those three doors. Five controls lock them:
| Control | Door it closes | What the data says |
|---|---|---|
| 1. MFA on everything, email and admin accounts first | Stolen credentials | Compromised credentials present in 38% of opportunistic attacks; credential theft typically precedes ransomware by weeks |
| 2. Kill legacy authentication | The bypass around MFA | Old protocols (IMAP/POP/basic auth) ignore MFA entirely — they un-lock door #1 |
| 3. Separate admin accounts from daily-use accounts | One phish becoming total compromise | Human behavior contributed to 62% of breaches; admin separation caps the blast radius of the inevitable click |
| 4. Backups you have actually restored, one copy offline or immutable | Ransomware's leverage | 69% of SMB ransomware victims refused to pay because backups held |
| 5. Patch internet-facing systems first, 7-day SLA | Edge exploitation | Unpatched edge devices present in 29% of opportunistic attacks; exploitation is now the #1 initial access vector |
That's the entire list. Not fifty controls — five, sequenced, each one closing a door the data says attackers actually walk through. Each is unpacked into a full implementation playbook — steps, owners, effort, pitfalls, and the evidence that proves it — in part 2 of this series.
The trivial many: what you're allowed to ignore for now
A Pareto strategy is defined as much by what it defers as by what it does. Until the five controls are at full coverage, you have standing permission to ignore: SIEM platforms and log analytics, threat intelligence feeds, penetration tests, security awareness platforms, EDR upgrades beyond what you already license, zero-trust architecture projects, and every vendor briefing that begins with "AI-powered." None of these are bad. All of them are optimizations of a house whose doors don't lock yet.
The trivial many have a seductive property: they feel like progress. A SIEM deployment has dashboards; a restore test is just a quiet afternoon and a dated note. Don't confuse visible activity with reduced risk — the breach data doesn't.
Spend rule: don't buy anything new until the five are done. Most small organizations already own unused security capability inside licenses they're paying for — turning it on is free. (More on that in the license audit.)
Evidence is part of the 20%
Every one of these actions — the inventory, the MFA rollout, the backup test — is evidence. When a framework, a customer questionnaire, or an insurer comes asking, the organizations that struggle aren't the ones that did nothing; they're the ones that did things and can't prove it.
Keep a simple log: what you changed, when, and why. Date your backup test results. Screenshot the MFA enforcement policy. This habit, started now, is the cheapest compliance program you will ever run — and it's why evidence belongs inside the vital few rather than after them. Compliance done well is a byproduct of operations done deliberately, not a separate project.
Define "good enough" out loud
You will never eliminate risk, and pretending otherwise burns people out and budgets down. The realistic goal is to be more expensive to attack than you're worth — and to recover when something gets through anyway. The 80/20 framing is how you say this to leadership without sounding like you're cutting corners: we are deploying the small set of controls that the breach data says prevents the large majority of incidents, completely, before spending anything on the rest.
That sentence reframes every future conversation from "are we secure?" (unanswerable) to "are we secure enough for what we're protecting?" (a real decision). It also survives contact with a board, an auditor, and an insurance underwriter — because it's how they think too. That conversation is the subject of its own article.
One more honest framing: your scarcest resource in this role isn't budget — it's attention. The Pareto principle is ultimately an attention-allocation rule. Every door you lock is a category of 2 a.m. problem you stop having, and the hours that frees are what fund everything that comes after.
Where to go next
This article is the argument. The rest of the series is the execution:
The 80/20 security program
- 1. Start here: the argument and the vital few You are here
- 2. The playbooks: deploying the five controls — step-by-step, with owners, effort, pitfalls, and evidence
- 3. The first 90 days: an execution plan for teams — week-by-week, with ownership, cadence, and an interactive checklist
- 4. Proving it works: five numbers and a quarterly review — coverage metrics, not activity metrics
And once the five are done and documented: pick up the gap assessment workbook to see where you stand against a real framework, seed your register from the risk library — and if you're a startup, a government contractor, in India, or facing an ISO ask, your situation has its own page.