Remote work moved a large part of most companies' attack surface into homes, coffee shops and airport lounges. The controls that assumed everyone was inside the office network stopped applying, and in a lot of organisations nothing replaced them.

Multi-factor authentication, everywhere

If you do one thing, do this. The overwhelming majority of account compromises we are called about would have been stopped by MFA. Enforce it on email, VPN, remote desktop and every administrative account. Prefer an authenticator app or a hardware key over SMS.

Manage the devices, not just the accounts

A secured account on a compromised laptop is not secured. Company data belongs on devices you can see: disk encryption on, endpoint protection running, updates enforced rather than suggested, and the ability to wipe a device remotely when it goes missing.

Patch on a schedule you can prove

Attackers overwhelmingly exploit vulnerabilities that already have a fix available. Automate operating system and browser updates, and keep an inventory so you know what is actually out there.

Assume the network is hostile

Public Wi-Fi should be treated as an untrusted network, because it is. Route work traffic through a VPN or a zero-trust access layer, and make sure home routers are not still running their factory default administrator password.

Train for the attack people actually face

Phishing remains the way in. Remote staff are more exposed to it because they cannot lean over and ask a colleague whether an odd email is real. Run simulated phishing, keep the training short and frequent, and make reporting a suspicious message completely blameless.

Back up, then test the restore

Ransomware is a backup problem before it is anything else. Keep an offline or immutable copy, and rehearse the restore before you need it under pressure.

None of these are exotic. Put them all in place and you have closed the paths behind most of the incidents we are called in to clean up.