Security budgets skew heavily towards products, while incident reports skew heavily towards fundamentals. The mismatch persists because fundamentals are unglamorous, continuous, and impossible to purchase.
Credentials
Stolen and reused credentials remain the most common entry point. Multi-factor authentication on every account that matters removes the majority of that risk, and it costs almost nothing.
The remaining gap is usually service accounts and API keys, which sit in repositories and configuration files, are shared between people, and are rotated approximately never. Those deserve a secrets manager and an expiry policy rather than another detection tool.
Patching
Most exploited vulnerabilities have had a fix available for a long time. The constraint is rarely awareness; it is that updating is risky when nothing is automated and there is no confidence in the tests.
Which makes patching a delivery problem. Teams that deploy easily patch quickly, and teams that dread deployment accumulate exposure. Investment in the pipeline is security investment.
Permissions
Access accumulates. People change roles, projects end, contractors leave, and permissions granted for one afternoon persist for years. This is what turns a single compromised account into a serious breach.
A quarterly review of who can reach what, and automatic revocation on role change, does more than most monitoring.
Backups you have actually restored
An untested backup is a belief. Restore drills — full restore, timed, into a clean environment — are the only way to know, and they routinely surface a missing dependency or an expired credential.
For ransomware specifically, at least one copy must be genuinely out of reach of a compromised administrator account.
Then buy tools, for the gap that remains
None of this argues against security products. It argues for sequence. Tooling layered over weak fundamentals produces alerts about a problem that better basics would have prevented, and it does so at considerable cost.
The unexciting controls are the ones that show up in the post-incident review. It is worth being honest about which of them are genuinely in place before buying anything else.