You do not need a large security department to get the essentials right. Use a password manager, enable multi-factor authentication and keep software up to date.

Limit access to what people need, back up regularly and practise restoring from a backup.

Most incidents come from missing basics, not exotic attacks.