You're the security team now. Start here.
Maybe you inherited security along with IT. Maybe a customer questionnaire or a cyber insurance renewal forced the issue. Either way, you're now responsible for security at an organization that has never had a security program, and every vendor on the internet wants to sell you the answer.
Here's the thing the vendors won't tell you: your first problem isn't a tooling problem. It's a prioritization problem. The entire field of security is engineered to feel infinite — endless threats, endless frameworks, endless products — and if you treat it as infinite, you'll spread one person's attention across a hundred controls and do none of them well. The way out is a very old idea.
Security has a Pareto distribution
The Pareto principle — the 80/20 rule — says that in most systems, a small minority of causes produces a large majority of effects. Security at small organizations is one of the strongest Pareto distributions you will ever see: a handful of weaknesses account for almost all real-world breaches, and a handful of controls close them.
This isn't a slogan; it's the picture that breach studies like Verizon's Data Breach Investigations Report paint year after year. Attacks on small organizations are overwhelmingly opportunistic, not targeted — automated scanning finds an open door, and the doors are never exotic: stolen credentials, unpatched internet-facing devices, and compromised email. The same three, every year, in every report. Describe those three doors and you've described nearly the entire SMB threat landscape.
The same studies carry the good news, which is the entire thesis of this site: organizations with tested, offline backups walk away from the ransom demand. One control, properly operated, converts a company-ending event into a bad week — that is the difference between the victims who recover and the victims who make the news.
One honest caveat, because it changes what "covered" means: modern ransomware crews usually steal data before encrypting it, then threaten to leak it — so backups defeat the encryption half of the attack, not the extortion half. That's why backups share the list with controls that limit what an intruder can reach in the first place (MFA, admin separation), and why "we can restore" is the start of your ransomware answer, not the end of it.
So the vocabulary for everything that follows, borrowed from Joseph Juran, who named the Pareto principle: the vital few — the small set of controls that eliminate most of your breach probability — and the trivial many — everything else, which is not worthless, but which must wait. Your job in year one is to identify the vital few, deploy them completely, and defend your attention against the trivial many.
The 80/20 rule cuts both ways. It promises that a focused program beats a sprawling one — and it warns that doing twenty controls at 40% coverage delivers almost nothing. A Pareto strategy only works at full coverage of the few. Half-done MFA is a locked front door next to an open window.
First, find your 20%: two lists
You can't apply the 80/20 rule to an environment you can't see. Before anything else, build two inventories:
- What we have. Every device, server, SaaS app, and data store that matters. Don't aim for perfect — aim for "nothing important is missing." A spreadsheet is fine.
- Who can touch it. Every account with admin rights, every shared password, every third party with access. This list is always longer than expected, and that's the point.
You can't protect what you can't see. Half of what looks like a security problem at small organizations is an asset and access problem wearing a costume — and most of what's dangerous is dangerous precisely because it's invisible: the forgotten admin account, the backup job nobody watches, the server everyone assumes someone else owns. The two lists are the act of dragging all of it into the light — and they're what tell you where your particular 20% lives. The vital few below hold for nearly every small organization, but your inventories are how you confirm it for yours.
The vital few: five controls that close the real doors
Small organizations don't get breached by nation-state exotica. They get breached through stolen credentials, compromised email, and unpatched internet-facing systems. Ransomware almost always arrives through one of those three doors. Five controls lock them:
| Control | Door it closes | What the data says |
|---|---|---|
| 1. MFA on everything, email and admin accounts first | Stolen credentials | Stolen credentials are the most common opening move, and credential theft typically precedes the ransomware event by weeks |
| 2. Kill legacy authentication | The bypass around MFA | Old protocols (IMAP/POP/basic auth) ignore MFA entirely — they un-lock door #1 |
| 3. Separate admin accounts from daily-use accounts | One phish becoming total compromise | Human behavior contributed to 62% of breaches; admin separation caps the blast radius of the inevitable click |
| 4. Backups you have actually restored, one copy offline or immutable | Ransomware's leverage | Tested backups take the ransom off the table for the encryption half of the attack |
| 5. Patch internet-facing systems first, 7-day SLA | Edge exploitation | Edge devices get exploited within days of a vulnerability disclosure — this door opens fast |
That's the entire list. Not fifty controls — five, sequenced, each one closing a door the data says attackers actually walk through. Each is unpacked into a full implementation playbook — steps, owners, effort, pitfalls, and the evidence that proves it — in part 2 of this series.
The trivial many: what you're allowed to ignore for now
A Pareto strategy is defined as much by what it defers as by what it does. Until the five controls are at full coverage, you have standing permission to ignore: SIEM platforms and log analytics, threat intelligence feeds, penetration tests, security awareness platforms, EDR upgrades beyond what you already license, zero-trust architecture projects, and every vendor briefing that begins with "AI-powered." None of these are bad. All of them are optimizations of a house whose doors don't lock yet.
The trivial many have a seductive property: they feel like progress. A SIEM deployment has dashboards; a restore test is just a quiet afternoon and a dated note. Don't confuse visible activity with reduced risk — the breach data doesn't.
Spend rule: don't buy anything new until the five are done. Most small organizations already own unused security capability inside licenses they're paying for — turning it on is free. (More on that in the license audit.)
Evidence is part of the 20%
Every one of these actions — the inventory, the MFA rollout, the backup test — is evidence. When a framework, a customer questionnaire, or an insurer comes asking, the organizations that struggle aren't the ones that did nothing; they're the ones that did things and can't prove it.
Keep a simple log: what you changed, when, and why. Date your backup test results. Screenshot the MFA enforcement policy. This habit, started now, is the cheapest compliance program you will ever run — and it's why evidence belongs inside the vital few rather than after them. Compliance done well is a byproduct of operations done deliberately, not a separate project.
Define "good enough" out loud
You will never eliminate risk, and pretending otherwise burns people out and budgets down. The realistic goal is to be more expensive to attack than you're worth — and to recover when something gets through anyway. The 80/20 framing is how you say this to leadership without sounding like you're cutting corners: we are deploying the small set of controls that the breach data says prevents the large majority of incidents, completely, before spending anything on the rest.
That sentence reframes every future conversation from "are we secure?" (unanswerable) to "are we secure enough for what we're protecting?" (a real decision). It also survives contact with a board, an auditor, and an insurance underwriter — because it's how they think too. That conversation is the subject of its own article.
One more honest framing: your scarcest resource in this role isn't budget — it's attention. The Pareto principle is ultimately an attention-allocation rule. Every door you lock is a category of 2 a.m. problem you stop having, and the hours that frees are what fund everything that comes after.
Where to go next
This article is the argument. The rest of the series is the execution:
The 80/20 security program
- 1. Start here: the argument and the vital few You are here
- 2. The playbooks: deploying the five controls — step-by-step, with owners, effort, pitfalls, and evidence
- 3. The first 90 days: an execution plan for teams — week-by-week, with ownership, cadence, and an interactive checklist
- 4. Proving it works: five numbers and a quarterly review — coverage metrics, not activity metrics
And once the five are done and documented: pick up the gap assessment workbook to see where you stand against a real framework, seed your register from the risk library — and if you're a startup, a government contractor, in India, or facing an ISO ask, your situation has its own page.