Of 10 classic security steps, 3 still hold; the missing one starts 31% of breaches

01Where breaches start, measured

Verizon’s 2026 Data Breach Investigations Report, covering more than 31,000 incidents and 22,000 confirmed breaches between 1 November 2024 and 31 October 2025, found for the first time that exploiting a vulnerability (31%) had overtaken credential abuse (13%) as the way in.^{1 2} A human action figures in 62% of breaches, ransomware in 48% and a third party in 48%. Only 26% of critical known-exploited vulnerabilities were fully fixed in 2025, and the median time to fix was 43 days.²

02The ten steps, re-scored

Read against that table, the 2022 list sorts into three piles. The counting is TechBag’s.

1. Still a staff habit (3 of 10). Step 2, never lending your account; step 4, locking the screen; step 8, confirming an unexpected attachment with the sender. They cost nothing, and pretexting is now tracked as an initial-access vector.³
2. Now a product with a price (5 of 10). Step 1’s strong password needs MFA or passkeys behind it, through an identity provider at US$3 to US$17 a user a month on list.⁷ Step 3’s network drive is a backup with an immutable copy. Step 6’s “use HTTPS, distrust Wi-Fi” is zero-trust access. Step 7’s ban on unapproved software is application control and SaaS discovery: 45% of employees now use AI tools at work, and 67% of that access runs through personal accounts.² Step 9’s weekly antivirus scan is an endpoint agent, ₹1,250 to ₹5,200 a seat a year on reseller lists.⁸
3. Obsolete (2 of 10). Step 5, shutting the PC down at night, works against you: a laptop that is off misses the patch window. Step 10, avoiding Internet Explorer, resolved itself when Microsoft retired the desktop app on 15 June 2022.⁹

The missing step is the one the data ranks first: patch every device within days of a critical fix. The modern ten-step list is CIS Controls Implementation Group 1, 56 safeguards of “essential cyber hygiene” with inventory, patching, MFA, backup and logging as the spine.⁴

03The legal floor in India

CERT-In’s Directions of 28 April 2022 require every body corporate to synchronise clocks to the NIC or NPL time source, report a listed incident within 6 hours, and keep logs of all ICT systems for 180 days within Indian jurisdiction.⁵ The DPDP Rules, notified on 13 November 2025, bring reasonable security safeguards and breach intimation, with a detailed report to the Board within 72 hours, into force on 13 May 2027.⁶ The Act sets penalties of up to ₹250 crore for failed safeguards and ₹200 crore for an unreported breach.¹⁰ Every licence above is a USD list price, invoiced in INR through a reseller with 18% GST; the 180 days of logs is a storage tier, and it is the item the regulator will ask to see.