For those of you in an infosec role at your company, what has been the one or two things that have made the most difference in the fight over the past several years?

Just curious on what other responses will be. For us in the past year, it was building out the entire security suite in MS E5/A5. If I look back at the last 5 years (I’ve been with my company 15) it was by far MFA with conditional access, which cut down on compromised accounts by 90%.

access accounts back compromised compromised accounts conditional access cybersecurity down infosec mfa role security things