Where the first dollar of your 2027 security plan should go

Stryker confirmed that on 11 March attackers compromised an administrator account, created a new Global Administrator and used Microsoft Intune's wipe command to erase data from nearly 80,000 devices. The company said it was not ransomware and no malware was deployed. The attackers did not break anything clever. They logged in as someone who was allowed to do the damage, and then they did it.

That is worth holding next to the way most 2027 security plans get written. A plan usually starts from the year's headlines, adds a vendor shortlist and ends with a budget line for whatever sounded most frightening in September. The result covers the incidents of last year very well and the incidents of next year not at all.

We would write it the other way round. Start from what keeps being found, and put the money where the same finding turns up again and again.

In Cyberlinx's own client work the repeats are plain. Seven of eight Cyberlinx clients assessed in Q4 CY2026 had findings in privileged access and multi factor authentication. Six of eight had findings in vulnerability management, patching or end of life software. Those figures come from anonymised audits and penetration tests, mostly for SMB organisations with some mid market and enterprise, across private and public sector. It is a small base, and it describes our clients, not the market. But it lines up with what the year's incidents showed, and that agreement is the reason we trust the order below.

First, identity and privileged access. Stryker is the clean example, because the whole attack ran through an administrator account and the platform's own tools. The Qantas contact centre breach is a different shape with the same root, a person talked into doing something an identity was permitted to do. In both cases the damage came from what the account could reach, not from the first foothold.

So the first money goes on making administrator accounts hard to take over and hard to misuse. Multi factor authentication that resists phishing for anyone with admin rights, and for anyone who can export data in bulk. Admin rights that are granted for an hour and then expire, rather than held permanently. An alert the moment a new global administrator appears. A second approver for any action that wipes devices or moves money. None of that needs a new platform. Most of it is configuration in the tenant a business already pays for.

Second, patching, and above all end of life and edge systems. The Palo Alto GlobalProtect flaw, CVE-2026-0257, is the plainest case this year. It is an authentication bypass that, according to Palo Alto's warning, lets an attacker establish an unauthorised VPN connection. Palo Alto patched it on 13 May, Rapid7 reported initial exploitation attempts on 17 May, four days later, and CISA listed it on 29 May. Arctic Wolf reported multiple Qilin ransomware intrusions from this flaw during June 2026. Reporting names Qilin and INC among the groups using it, and says they went from the VPN to a VMware vCenter management appliance and dumped credentials offline.

The lesson in that story is that a fixed flaw in a device facing the internet is the cheapest door an attacker will ever find, and that attempts began within days of the patch. For a software or fintech business, where the VPN and the admin consoles guard customer data and code, that means a patch deadline for internet facing devices measured in days, and a list of every gateway and appliance so that none is forgotten. For a council running older systems, it also means deciding, with a date, which end of life platforms are being replaced and which are being fenced off.

Third, keep the management system alive with dated evidence. This is the least exciting item and it is where the audits are most consistent. In our ISO 27001 audit work in Q4 CY2026, a risk register and Statement of Applicability that had not been refreshed, and controls marked as implemented with nothing behind them, kept turning up. A control marked implemented with no record is worse than an honest gap, because it fails at audit and gives the board comfort it has not earned. In fintech and financial adviser software, buyers and regulators ask for proof that a control operates, not a policy that says it should. A dated record is the answer to that.

So the order is identity, then patching, then evidence, and the reason for the order is cost against reach. The first item closes the route used in the incidents we checked. The second closes the cheapest route into a perimeter. The third makes sure the first two stay done.

What to do this week

• List every account with administrator rights and check each one has phishing resistant multi factor authentication. Remove the ones that nobody can justify.
• Set an alert for new global administrators and for bulk device actions, and name who receives it.
• Produce one list of every internet facing device and its patch status, and put a date on anything older than the vendor's fix.
• Pick five controls marked implemented in your Statement of Applicability and find the dated record for each. Where there is none, correct the status.

That is a short list and it will not make a good keynote, but it is the list the evidence supports.

Next step

If you would like a second pair of eyes on the order of your 2027 plan before it goes to the board, reply to this post or get in touch with the Cyberlinx team.