A reused password or passphrase turns one leaked service into a key for email, SaaS tools, admin panels and shared drives. Use a company password manager and replace reused secrets first.

Company policy should favor long, unique passphrases and block known-compromised choices. Do not force routine password changes when that creates Password01, Password02 patterns; rotate when there is suspicion of compromise, reuse, role change or exposure.

Start with company email security: unique passwords, multi-factor authentication, recovery codes, and clean recovery ownership. If email falls, many business tools can follow.

When a message asks for money, passwords, files, payroll changes or urgent action, pause. Open the site yourself or verify through a second channel before acting.

Attackers often use vulnerabilities that already have fixes. Managed updates for laptops, phones, browsers and routers remove many easy paths into the company.

Employees, vendors, apps and service accounts should only have the access they need. Remove old apps, shared folders and admin rights that nobody can explain.

Sync copies changes, including bad changes. A useful backup has another copy, a recovery path, and at least one successful restore test.

Branding, signatures, names and copied email threads are easy to imitate. Trust known channels, bookmarks, saved contacts and direct verification more than the look of a message.

Public profiles, app permissions, shared links and old accounts quietly create company risk. Reduce what is visible, searchable, linkable and reusable.

Small repeatable routines matter: update checks, access reviews, recovery checks, joiner-mover-leaver cleanup, and a simple way to report suspicious messages.

Screenshots, support tickets and AI prompts often contain tokens, customer data, employee details or internal documents. Treat them like publishing unless the place is trusted.

Security belongs in product decisions, design reviews, backlog grooming and pull requests. Keep it lightweight: ask what can go wrong, what data is exposed, and what guardrail would prevent the obvious mistake.

Treat security work like reliability work: visible, owned and planned. Critical fixes, exposed secrets and broken access controls should interrupt the roadmap because they can interrupt the business.

Multi-factor authentication buys time when a password leaks. Prefer app prompts, authenticator codes or security keys for company accounts. SMS is weaker, but still better than nothing.

Passkeys are much harder to phish because there is no password to type into a fake page. Enable them first on important company accounts, then confirm recovery and break-glass access still work.

Updates close known holes. Enable managed updates and restart devices regularly. Remove old apps, unmanaged tools and browser extensions the team no longer uses.

Back up critical documents, finance records, source files and configuration somewhere separate from the device. Test restoring one file so the backup is not just decoration.

When MFA is enabled, store recovery codes or break-glass procedures somewhere protected, documented and separate from day-to-day devices.

Use your password manager's health report or breach check. Prioritize email, finance, cloud storage, admin tools, source control, HR systems and SaaS accounts with payment access.

Set real passcodes, enable biometrics, shorten auto-lock, and avoid shared unlock codes. A device unlock often exposes email, chat, files, admin tools and finance apps.

Remove extensions the company does not need. Keep trusted extensions with clear value, and check permissions before approving them for teams.

Enable device finding or MDM inventory. Confirm IT knows which account controls remote lock and erase for company devices.

Review app and SaaS permissions. Remove access that does not match the job, especially contacts, calendars, files, microphone, camera and location.

For banking, payroll, tax, cloud admin and work tools, open the site yourself. Links in emails and ads are common paths to fake login pages.

Write down the emergency steps: bank contacts, device erase links, password manager recovery, payroll or finance contacts, and who approves urgent payments.

Use separate browsers, profiles or devices where possible. Do not sync personal passwords into work browsers or company documents into personal cloud accounts.

Before using an AI tool, ask what data you are pasting, whether the tool is approved, and whether the same result can be achieved with a sanitized example.

Track open-source packages, base images and SaaS SDKs. Update high-risk dependencies quickly, remove unused packages, and keep a clear owner for dependency alerts.

Scan commits and CI logs for API keys, tokens, private keys and credentials. If a secret lands in the wrong place, rotate it instead of only deleting it.

Limit who can change CI workflows, deployment scripts and release credentials. Use approvals for sensitive environments and keep build logs free of secrets.

For new flows, ask what assets are touched, who can call it, what happens if input is hostile, and what audit trail exists. Write the decision down where engineers will see it.

Use a strong unlock code, enable device management, know how to erase remotely, and make sure the password manager and company email are protected by a second factor.

Do not rely on email alone for bank details or urgent payment changes. Confirm through a known phone number or another trusted channel before sending money.

Use HTTPS sites, avoid entering passwords after strange redirects, and turn off local sharing. For offices and remote work, keep routers updated and Wi-Fi access controlled.

Company privacy is deciding who gets to know what. Review app permissions and remove access that does not match the job the app is supposed to do.

Scammers use compromised accounts and familiar names. Confirm through a known channel before sending money, codes, gift cards, payroll changes or bank details.

QR codes are links. Check where they lead before entering passwords or payment details, especially in public places or on stickers over official signs.

Use separate user accounts or browser profiles. Do not leave password managers, email, cloud drives or work tools open for the next person.

Do not call the number or install the tool. Close the tab or browser, update the browser, and run the security tool already trusted on the device.

Open the service directly, change the password, enable MFA, review connected apps, and check whether the password was reused by anyone else. Watch for follow-up scams using breach details.

Disconnect affected devices, preserve evidence, escalate quickly, and restore from a known-good backup. The best time to assign roles and contacts is before the screen locks.

Before pasting, remove customer names, credentials, private links and commercial details. Use approved tools for sensitive work material.

Set screen locks, device management, required apps, password manager access and account recovery before handover. Teach the person how to report suspicious messages.

Check whether the vulnerable dependency is used, reachable and deployed. Patch or remove it, document the decision, and avoid silent exceptions that nobody will revisit.

Assume the secret was exposed. Revoke or rotate it, check logs for use, remove it from history where needed, and add a guardrail so the next one is blocked earlier.

Before release, confirm authentication, authorization, logging, rate limits and sensitive data handling. The fastest fix is usually the one made before customers depend on the feature.

Every important exception should say what the risk is, who accepted it, why it is tolerable, and when it will be reviewed. The goal is clarity, not paperwork for its own sake.

For skipped controls, record the reason, expiry date, compensating control and accountable owner. Review exceptions before they become permanent architecture.

Keep lightweight records for access reviews, policy decisions, vendor approvals and incident actions. Good evidence shows that the company made deliberate choices.

Before approving a vendor, look at the data it will touch, the access it needs, how it authenticates users, and how the company can leave cleanly later.

List vendors with access to files, admin panels, support tools, source code or customer data. Remove stale accounts and require MFA for external access.

Export needed records, revoke integrations, disable users, delete unused tokens, close shared links and confirm what data the vendor retains after the contract ends.

Security promises should match how the product actually behaves. Use secure defaults, clear privacy choices and honest incident communication instead of vague trust language.

Review product defaults for sharing, visibility, exports, invites, retention and notifications. A default that surprises customers creates support, privacy and trust risk.

Contain the issue, preserve logs, identify affected data, notify the right internal owners, and communicate with customers in plain language when required.

Badges, visitors, meeting rooms, printers and unattended screens all touch company security. Keep office habits simple enough that people actually follow them.

Remove sensitive printouts, wipe meeting-room boards, lock screens before leaving and avoid leaving visitor-visible dashboards open in shared spaces.

Use reception or host check-in, challenge unknown people kindly, and keep visitor access limited to the rooms and time they actually need.

Policies, DPAs and privacy notices are only useful if systems and teams follow them. Keep retention, access and processing choices understandable.

Identify where customer, employee, financial and regulated data live. Note owners, retention, access, vendors and whether the data is still needed.

Confirm identity, find the relevant systems, involve legal or privacy owners, track deadlines, and record what was deleted or retained with a reason.

Security culture is built in the first reaction to mistakes. Make suspicious-message reports, lost-device reports and accidental leaks easy to raise early.

Give employees a simple way to report suspicious emails, lost devices, exposed data and payment concerns. Respond with useful feedback so the habit sticks.

Thank the person for raising it, contain the account or device, check what was entered or downloaded, and use the lesson to improve guardrails.

Cloud security depends on identity, configuration, network exposure, backups and monitoring. Treat cloud accounts like production systems, not storage drawers.

List privileged cloud users, service accounts and deployment roles. Remove stale access, require MFA, separate environments and keep logs long enough to investigate.

Restrict access, preserve evidence, identify what was exposed, rotate any leaked secrets, review logs and add a control that catches public storage before release.