Maximising IT Security on a Tight Budget

I'm in IT Security at a small company with a tight budget. Unfortunately, we can't afford a pen test right now. So, I'm looking for advice on any tools and methods to use to identify and shore up any potential vulnerabilities or gaps. Has anyone been in a similar situation and can share their insights?

Thanks!

advice budget cybersecurity identify it security pen pen test security share test tools vulnerabilities