2026 Top 35
Reordered for the Modern Threat Landscape
A reordering of the original DSD Top 35 strategies, elevated to address the 2026 threat landscape: identity-first attacks, AI-automated exploits, and supply chain fragility.
Multi-factor Authentication
ElevatedSpecifically phishing-resistant (FIDO2/Passkeys). Identity is the new perimeter.
Regular Backups
ElevatedMust be Immutable and Offline. Resilience is measured by your ability to restore, not just protect.
Patch Applications
Extreme RiskThe 48-hour rule is now the standard for critical vulnerabilities.
Patch Operating Systems
Extreme RiskIncludes network devices and "edge" hardware which are now primary targets.
Application Control / Whitelisting
Essential for stopping AI-generated malicious payloads.
Restrict Administrative Privileges
Minimising the "blast radius" of a single credential compromise.
Network Segmentation and Segregation
ElevatedCrucial for containing lateral movement in an "Assume Compromise" world.
Centralised & Time-Synchronised Logging (Computer Events)
You cannot defend what you cannot see. SIEM/XDR integration is mandatory here.
User Application Hardening
Disabling unneeded features (Java, OLE) to shrink the attack surface.
Microsoft Office Macro Settings
Blocking all macros by default unless digitally signed and vetted.
Assess your current resilience score
Use our 2026 Resilience Scorecard to rate your organisation against the critical controls.