A simple starting point for me was checking password reuse and enabling hardware-based 2FA everywhere possible. It’s surprising how much risk disappears just from that.