Most break-ins start with a password that was reused, guessed, or stolen in someone else's breach. Use a password manager so every account has a long, unique password you do not have to remember. Turn on multi-factor authentication (MFA) everywhere it is offered, starting with email, banking, and anything with customer data; an authenticator app or a security key is stronger than a text message. Never share a password by email or chat, and never approve an MFA prompt you did not trigger yourself; a surprise prompt means someone has your password, and the right response is to deny it and tell IT.

• Password manager: long, unique passwords everywhere.
• MFA on email, finance, and customer data first.
• Never approve an MFA prompt you did not start.