The Corporate Security Checklist I Use at Every Company
Before any fancy testing, I check the basics. Most real breaches I've seen came through one of these gaps, not a zero-day. You can run through the interactive version on my Services page.
Identity & access
MFA everywhere that matters, least privilege, no shared admin accounts and leavers disabled the same day. Stolen credentials remain the easiest way in.
Applications
Annual VAPT with retests, API testing for broken object-level authorization, mobile tests before major releases and SAST in the pipeline.
Infrastructure & cloud
Know every asset, patch critical CVEs within 14 days, no public storage or open admin ports, CIS-hardened servers and real network segmentation.
Monitoring & response
Logs in a SIEM, EDR on every endpoint, someone watching 24/7, an IR plan with names on it, offline tested backups and a forensics partner before you need one.
AI & people
Review AI apps before go-live, set a policy for what data goes into AI tools, train staff on phishing and developers on secure coding.
Tools mentioned
Close the basics first. They're boring, cheap and stop most of what actually happens.