Annual slide decks produce certificates, not habits. Short frequent training, phishing simulations run fairly, a culture of reporting, honest measurement and visible executive participation are what change behaviour.
A scan is automated, broad and frequent; a penetration test is human-led, deep and periodic. What each finds, how scope and rules of engagement work, how to read the results, and when each is required.
Which accounts to protect first, why authenticator apps beat text messages, conditional access rules that keep friction where the risk is, and how to handle shared mailboxes and service accounts.
MFA everywhere that matters, monitored EDR, tested offline backups, patching, filtering, training and a plan. What the questionnaire really asks, and why optimistic answers are dangerous on the day of a claim.
SPF lists your senders, DKIM signs the message, DMARC sets policy and tells you what is happening. What alignment means, how to progress from none to reject, and the mistakes that block your own mail.
Antivirus recognizes known bad files; EDR watches behaviour, records what happened and can isolate a device or roll back damage. Why the difference matters, who watches the alerts, and why insurers ask.
No single control catches everything. Follow a typical attack step by step and see exactly where each security layer gets its chance to stop it, plus a sensible order to build them in.
Most successful attacks on a business start with an email that looked entirely normal. Here is what those attacks look like now, what a single one costs, and the controls that genuinely reduce the risk.
