Given limited time, prioritizing attack surface reduction—taking down legacy systems, updating unmaintained dependencies, and strengthening network isolation—is a defense direction with an extremely high cost-benefit ratio.