SecurityMFA, patching, backups, and least privilege access — in our experience these four controls stop the large majority of incidents we get called in to investigate. Here's how to roll them out without disrupting a small team.