Most of the breaches I read about follow the same pattern: no exotic exploit, just a missed update, a reused password, or a backup that never got tested. Attackers got faster and cheaper to run, but so did the defense. Most of it is free, most of it is unexciting, most of it works. Here is what I actually do, roughly in the order I would do it again.

Email first, because email is the master key

Whoever controls your inbox can reset every other password you own. So that is where I start: a long unique password, a TOTP app or hardware key, and no SMS codes (SIM swapping is a real business, not a movie plot). Use a separate alias per service when you can — one leaked database then stops being a spam and phishing festival aimed at your real address.

One password per site, or a passkey

Password reuse is how one breach becomes five. A password manager removes the excuse: it generates something ugly per site, and you only ever type one master password. Where passkeys exist, use them. Where they do not, let the manager invent a 24-character mess you never have to look at.

MFA everywhere it is offered

Not just on the accounts you care about. On all of them, including the boring ones. Attackers chain boring accounts into access to interesting ones, and a TOTP code stops that chain cold.

Patches, on a schedule, automatically

The vulnerability used against you is usually months old. A fix sitting in a pending-updates menu protects nobody. Turn on automatic updates everywhere and accept the occasional reboot — a reboot is a smaller disruption than a restore.

Backups you have actually restored

3-2-1: three copies, two media, one off-site. Ransomware encrypts what it can reach, so at least one copy should be offline or append-only. And test the restore. A backup that has never been restored is a hope, not a plan.

Peek at the logs once a week

On any machine that faces the internet, this takes ten seconds:

journalctl -u ssh --since "-7 days" | grep -c "Failed password"
journalctl -u ssh --since "-7 days" | grep "Failed password"   | grep -oE "from [0-9.]+" | sort | uniq -c | sort -rn | head

Steady noise is normal. A spike means something changed, and usernames that are not dictionary words mean someone is aiming at you specifically.

Urgency is the tell

AI made phishing near-perfect: no typos, correct logos, plausible voice clones. What it cannot fake is the situation. A real bank never calls to ask for a code, and no real admin ever asks for your password. When an email or a call creates urgency, slow down and call back on a number you already know.

The LAN is not a trust boundary

Assume everything around you is hostile: the office Wi-Fi, the hotel network, even the router at home. Expose services through identity instead of ports — a private mesh (NetBird, Tailscale) or a reverse proxy with real auth. If a service does not need to be public, it should not be reachable at all.

Do all of it once. After that, security is a restore test every few months and a new device every few years. You get to forget about it, which is what good defense should feel like.