Expected breach incoming

Just started working for a small business startup in the healthcare space. > 50 employees. Their security controls are pretty much 0 besides AV. Everybody has access to everything and nobody does anything about anything. I’m surprised they haven’t already been breached (as far as I know) im waiting to come in one day and all of our shit is just locked down with ransomware

access breach breached business controls cybersecurity down employees healthcare locked ransomware security security controls space startup working