October gives us an official excuse to revisit the security fundamentals every year. But the basics shouldn’t be a seasonal topic, because they’re the struggles that lead to breaches every single month.

Everything applies whether or not you use AI. It’s the fastest way to run your defense, because attackers are already using it. If your organization is slower to adopt AI, the list actually still holds. We’ve found that 50% of AI tools are operating under the radar (that’s shadow AI.) AI workloads are identified at runtime, operate in the cloud, and are secured the same way as all else.

The data proves it: Basic gaps stills cause breaches

Before digging into the “what to do,” let’s start with the justification as to why we need to do these things.

Verizon’s 2026 Data Breach Investigations Report (DBIR) was built from more than 22,000 confirmed breaches. System intrusion and social engineering combined account for 78% of breaches. Additionally, vulnerability exploitation overtook credential abuse as the top initial access vector, appearing in 31% of breaches — a 55% increase year over year.

Additionally, the human element still appears in 62% of breaches, and third-party and supply chain involvement jumped 60% year over year to 48% of all breaches. Blame the lack of MFA, unrotated or exposed credentials, and lack of least privilege implementation.

Identity is a common thread. Google Cloud's Threat Horizons Report H1 2026 found compromised identities in 83% of cloud and SaaS intrusions in the second half of 2025. The Sysdig 2026 Cloud-Native Security and Usage Report found that 97.2% of managed identities within CSPs belong to machines. The 2024 report found that only two percent of granted permissions were being used, which leaves 98% of granted access sitting there for an attacker.

Skip the basics and it’ll cost you

IBM’s 2026 Cost of a Data Breach Report puts the global average just shy of $5 million, up 12% year over year. The US average is a whopping $11.5 million. If you’re wondering why that can climb so high, in some cases, like a DDoS attack or the rare destructive ransomware attack, this includes downtime. According to the ITIC’s 2024 Hourly Cost of Downtime Survey, for large enterprises, a single hour of downtime costs over $100,000, with industries like finance, healthcare, media, and communications reaching well over $5 million per hour. That means a critical service outage spanning the length of an average workday could cost a business tens of millions of dollars during recovery.

Every basic security fundamental you need, in one place

If you haven’t caught on yet, the pattern across every single one of these reports is the same: The fundamentals aren’t being executed consistently (if at all), and those gaps are exactly why attackers keep getting in. What follows isn’t new or unique, and that’s the point. Here’s the full list:

Identity and access management

Enforce MFA on every human account with elevated privileges, especially cloud admin and root. There should be no exceptions for “just this one admin.”
Give service accounts short-lived credentials and workload identities instead of long-lived keys.
Apply the concept of least privilege to every human and non-human identity. Excessive permissions for service accounts and CI/CD pipelines are as dangerous, if not more dangerous, as excessive permissions for human accounts, because they are increasingly being targeted by threat actors.
Audit and revoke access on a scheduled cadence, not on a whim. Temporary access required for a migration, incident investigation, or marketing project should expire automatically, not linger for six months. (Seriously consider automating the access review process in full.)
Rotate credentials and API keys on a fixed cadence, and immediately after any personnel changes or third-party service offboarding. (You can automate this too!)
Monitor for anomalous identity behavior at runtime in addition to during initial login. A valid credential doing something it's never done before, from somewhere it’s never logged in from before, or at a weird time of day, is still a signal.

Vulnerability and patch management

Patch based on exploitability and exposure, not just CVSS score. A mid-severity flaw on an internet-facing workload will be exploited before a critical one buried three layers deep.
Close the remediation gap. Only 26% of critical vulnerabilities in CISA’s KEV catalog were fully remediated last year. Track time-to-remediate as a KPI, not a footnote.
Scan images and dependencies before they reach production, and continuously scan running workloads, because a clean image today can have a new CVE tomorrow.
Maintain an accurate software inventory (SBOM) so you know what's actually running when a new CVE drops. You can't patch what you can't see.

Cloud and Kubernetes configuration

Run continuous posture checks against every account, across your entire enterprise. Configuration can drift between static scans, so scan continuously.
Lock down storage by default and only expose it if it’s necessary. Public buckets and open blobs are common, preventable exposure paths in a cloud service provider.
Restrict network exposure. Close unused ports, tighten security groups, and don't let permissive firewall rules become the default because someone was in a hurry. Add network policies in Kubernetes because pod traffic is open across namespaces by default.
Scope Kubernetes RBAC to least privilege. Use namespace-scoped Roles instead of cluster-wide ones where you can. Treat every cluster-admin binding as an exception that needs an owner, because cluster-admin handed out liberally is a lateral movement problem waiting to happen.
Disable or tightly scope pod privilege escalation, hostPath mounts, and privileged containers unless there's a legitimate reason for it. If so, monitor its behavior for anomalous usage.

Runtime detection and response

Deploy runtime sensors on every workload, because static build-time scanning misses what happens after deployment.
Detect drift the moment it happens. A container that starts running a binary that wasn't in the original image is a red flag.
Mapping detections to MITRE ATT&CK helps your team know what technique they're looking at and responding to, not just, "something fired, what happened?"
Tune alerts against actual behavior baselines from your environment. Alert fatigue will diminish your triage speed and false positives waste time you don’t have.
Have tested containment actions ready to go when high-fidelity alerts fire. Detection without a response playbook just documents the breach as it happens, and you’ll watch it fly by.

Logging, monitoring, and visibility

Centralize logs across cloud, container, and identity layers. Fragmented logs mean fragmented investigations, and that means slow speed.
Enable audit logging everywhere and verify it's actually capturing what you think it is.
Retain logs long enough to investigate. Mean time to identify and contain sits at 247 days; a 30-day data retention window only covers 12% of that.
Correlate signals across layers. An IAM anomaly plus a runtime anomaly on the same workload is a different story than either alone.

Supply chain and CI/CD management

Scan third-party dependencies and container base images continuously, not just at import.
Treat CI/CD credentials and pipeline permissions with the same scrutiny as production access. Compromised pipelines lead to compromised production.
Vet and monitor vendor and partner access. Third parties now factor into 48% of breaches.
Sign and verify artifacts through the pipeline so nothing unverified reaches a runtime environment.

Governance

Assign clear ownership for every basic item on this list. Stopping at "security is everyone’s responsibility" is how things fall through the cracks.
Write down what's approved (hello AI tools.) Set a policy for approved tools, what data can go in, and who approves new ones. Of the organizations with an AI-related incident, 68% had no AI governance policy.
Enforce the policies you write. A ban with no usage detection is a suggestion.
When exceptions are given, assign an owner and an expiration date.
Anchor to established frameworks. For example, use NIST AI RMF for AI risk and the OWASP Top 10 for LLM Applications works as a complementary threat checklist.
Revisit these fundamentals on a real cadence, not just every October.

People and process management

Train for the social engineering people actually see now: Voice phishing, MFA fatigue prompts, and help desk impersonation, not just email attachments.
Practice incident response before an incident, with the people who'll actually be on the call.
Report metrics to leadership on a regular schedule. Include things like MFA coverage on privileged accounts, percentage of identities at least privilege, and time to remediate known exploited vulnerabilities.

Your takeaway

Every suggestion above traces back to a control that already exists and already works. MFA works. Least privilege works. Patching works. Runtime visibility works. The breaches keep happening because these fundamentals get treated as a checklist to revisit once a year instead of a discipline to run every single day.

Cybersecurity Awareness Month is a fine reminder. Just don't let it be the only one.