Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteOrganizations can reduce cyber risk by strengthening everyday security controls before adding more advanced tools. In an opinion article for CSO Online, published September 18, 2026, Edwin Ng argues that technology such as AI can add value, but works best on a sound foundation. His priorities: know what you own, protect identities, focus on critical risks, prepare to recover, and explain security in business terms.
How can organizations reduce cyber risk?
Start by checking whether the organization can see, protect, and recover its important systems and data. Ng’s recommendations are not a product comparison or a claim that any single control eliminates risk. They are a practical sequence: establish a reliable picture of the environment, strengthen access, direct effort toward the most consequential threats, plan for disruption, and make risk understandable to decision-makers.
As an Amazon Associate I earn from qualifying purchases.
What security fundamentals should leaders prioritize?
1. Maintain a dependable asset inventory
You cannot reliably protect assets you do not know exist. Ng recommends discovery that covers on-premises systems, cloud and multicloud environments, endpoints, and third-party applications, with scattered records consolidated into an accurate, maintained source of truth.
An inventory is useful only if it answers operational questions, not merely if it produces a list. Check that it records who owns each asset, whether records are complete and current, how often they are refreshed, and whether relevant security processes can use the data. Discovery coverage should include the places the organization actually operates; an inventory that omits a cloud account or external application can leave a real blind spot.
#1 Best Overall
- A great fit for 2-4 bedroom homes, this Alarm Kit includes one Base Station, two Keypads, eight Contact Sensors, two Motion Detectors, and one Range Extender.
- Includes an intuitive Keypad that can arm and disarm your Alarm and Contact Sensors that detect when doors or windows open.
- Choose the Ring Alarm Kit that fits your needs and detect even more with additional Alarm Sensors and accessories (sold separately) at any time.
- Receive mobile notifications when your system is triggered and monitor all your Ring devices all through the Ring app.
- More peace of mind. Subscribe to a compatible Ring Protect Plan (sold separately) to Arm your Alarm from anywhere, keep your system online if the Wi-Fi goes down, and more. Plus, get 24/7 Professional Monitoring for emergency police, fire and medical response, and more.
2. Strengthen identity safeguards
Ng recommends multifactor authentication (MFA) and says organizations should consider going further with passkeys. Neither should be treated as a complete solution: account recovery, deployment coverage, interoperability, and the user experience also matter.
Passkeys are a promising option, but published adoption and performance figures need context. In its October 2025 Passkey Index, the FIDO Alliance reported that among contributing member companies, 93% of accounts were eligible for passkeys, 36% had a passkey enrolled, and 26% of sign-ins used passkeys. Those are participating-company figures, not universal adoption rates. The index also reported an average passkey sign-in time of 8.5 seconds versus 31.2 seconds for the traditional approaches it compared, and a 93% passkey sign-in success rate versus 63% for other methods. These are reported index findings, not a guarantee for a particular organization or deployment. See the FIDO Alliance Passkey Index announcement for its scope and methodology.
Rank #2
- A great fit for 1-2 bedroom homes, this kit includes one base station, one keypad, four contact sensors, one motion detector, and one range extender.
- Includes an intuitive Keypad that can arm and disarm your Alarm and Contact Sensors that detect when doors or windows open.
- Choose the Ring Alarm Kit that fits your needs and detect even more with additional Alarm Sensors and accessories (sold separately) at any time.
- Receive mobile notifications when your system is triggered and monitor all your Ring devices all through the Ring app.
- More peace of mind. Subscribe to a compatible Ring Protect Plan (sold separately) to Arm your Alarm from anywhere, keep your system online if the Wi-Fi goes down, and more. Plus, get 24/7 Professional Monitoring for emergency police, fire and medical response, and more.
Ng’s article also repeats a claim that MFA-protected accounts are “99% less likely” to be hacked and attributes it to CISA. The original linked CISA page was inaccessible during the research underlying this article, so that statistic cannot be independently verified here and is not presented as an established figure.
3. Put effort where business risk is greatest
Security spending should reflect the organization’s risk appetite and protect critical products, services, and data first. Leaders can assign priorities and use a shared framework rather than treating every weakness as equally urgent. Ng names the CIS Critical Security Controls; the Center for Internet Security describes them as a prioritized, prescriptive set of practices and lists CIS Controls v8.1 as its latest version on the official CIS Controls page.
Rank #3
- Simple to set up. Seriously secure - Get ready to protect right out of the box. Just plug in the Base Station, download the SimpliSafe App, place your sensors, and start protecting your home. No wiring or drilling required. Or contact SimpliSafe directly if you need help installing your system.
- 1 FREE month of professional monitoring for fast police response when you need it most. With optional monitoring services, our agents keep watch even when you can't, ready to instantly alert emergency responders. Starting at less than $1/day with no long-term contracts or hidden fees. (SimpliSafe products and professional monitoring services are only offered for sale and supported in the US)
- Complete control of your system with the SimpliSafe App - Arm, disarm and protect anytime, anywhere.
- Protection for entry points - Entry Sensors protect windows, doors, and cabinets and alert you when someone tries to enter. Customizable and can send Secret Alerts so you are quietly alerted if someone accesses private areas, without sounding an alarm.
- Blanket a whole room - Motion sensors detect motion within 35 feet, have a 90 degree field of view and get along great with pets under 60lbs. Perfect for full room coverage when placed in a corner.
Frameworks help organize work, but they do not make prioritization automatic. The useful question is which exposures could disrupt a critical service, compromise important data, or undermine an essential business commitment—and which controls most directly reduce that risk.
4. Plan for detection, response, and recovery
Prevention remains important, but it cannot be the whole plan. Ng recommends being able to identify incidents quickly, respond, maintain secure system and data backups, and recover through plans that have been practiced. As he puts it, “The quicker you can identify a breach in progress, the quicker you can shut it down.”
Rank #4
- Like-New Ring Alarm 8-piece kit is refurbished, tested, and certified to look and work like new and comes with the same limited warranty as a new device. Like-New Amazon devices may be packaged in generic Amazon-branded boxes.
- A great fit for 1-2 bedroom homes, this kit includes one base station, one keypad, four contact sensors, one motion detector, and one range extender.
- Includes an intuitive Keypad that can arm and disarm your Alarm and Contact Sensors that detect when doors or windows open.
- Choose the Ring Alarm Kit that fits your needs and detect even more with additional Alarm Sensors and accessories (sold separately) at any time.
- Receive mobile notifications when your system is triggered and monitor all your Ring devices all through the Ring app.
A backup is not proof that recovery will work. Organizations need to establish that the right systems and data can be restored securely, and that responders know their roles. Ng’s article does not prescribe a recovery-time objective, a testing schedule, or a particular product; those decisions need to reflect the organization’s services and tolerance for disruption.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Give technical and business teams a shared language
Security leaders need to translate technical risk into consequences that business stakeholders can assess. Ng recommends quantifying risk where the evidence supports it, including possible lost business, regulatory penalties, and reputational damage. He also recognizes a key limitation: estimating losses from incidents that did not happen is difficult. A financial estimate should therefore make its assumptions visible rather than imply more precision than the evidence allows.
Best Value
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
“Bridging that communications gap is critical,” Ng writes. Clear explanations help leaders weigh security work against business priorities without reducing every decision to a technical score.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should organizations prepare to recover from a cyber incident?
- Identify critical services and data. Determine what must be restored first and who owns the recovery decision.
- Connect response to recovery. Make sure incident identification and response procedures lead into a defined recovery plan, rather than treating backup as a separate, self-sufficient safeguard.
- Protect backup copies. Include system and data backups in the security plan and consider how they would remain available and trustworthy during an incident.
- Practice the process. Rehearse recovery so teams can find gaps in responsibilities, access, or restoration procedures. Choose targets and a testing cadence that fit the organization; Ng’s article does not specify fixed values.
How to judge whether a security initiative is addressing the fundamentals
Before selecting a tool or expanding a program, ask whether it closes a real gap in the organization’s security foundation:
- Asset visibility: Does it cover the organization’s actual environments, provide dependable ownership and data quality, and keep records current?
- Identity: Does it protect the accounts that matter, work with the organization’s identity systems and devices, and provide a workable recovery path?
- Risk alignment: Does it prioritize critical assets in a way that reflects business risk appetite?
- Recoverability: Can teams demonstrate through practice that important systems and data can be restored?
- Decision value: Do its risk measures help business leaders make a choice, with assumptions clear where estimates are uncertain?
Ng is LogicGate’s CISO and formerly served as CISO of Hyatt Hotels Corporation, according to his article biography. His recommendations should be read as an executive’s opinion on security priorities, not as an independent evaluation of vendors or tools.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
