Summary
This post is for IT leaders heading into the final quarter of 2026. It acknowledges a demanding year and sets out a short end-of-year security review. It covers six areas: looking back at the year's incidents, identity and phishing awareness, external exposure and patching, backup and incident response, AI use and shadow AI, and showing progress to auditors and insurers. Each section focuses on small, practical wins rather than major projects. It also explains how CommSec's Managed SOC and AI Detection and Response help teams monitor their environment around the clock. A 10-point checklist accompanies the post.
Before 2027: Security Quick Wins to Finish the Year Strong
It has been a big year. Most IT teams we work with have spent 2026 juggling new projects, tight budgets, compliance deadlines and the arrival of AI in almost every corner of the business. If you have made it this far, you have done a lot of hard work, and that deserves recognition.
If there is any fuel left in the tank, the last few weeks of the year are a good moment to take stock. A short review now means you can start 2027 with a clear roadmap, rather than a list of loose ends.
The numbers make a good case for a quick review. IBM’s 2026 Cost of a Data Breach Report puts the global average cost of a breach at $4.99 million, up 12% on last year. It also found that breaches took an average of 247 days to identify and contain. Speed makes a real difference to the bill. Breaches contained within 200 days cost an average of $4.32 million, compared with $5.65 million for those that ran longer.
AI has added a new layer to that risk. AI usage has exploded across businesses this year, and so have AI creep and shadow AI. AI creep is when assistants and agents quietly gain access to more systems and data than anyone intended. Shadow AI is when staff use AI tools that IT has never approved, or even seen. Both widen your attack surface, and few businesses have had the time to keep track of either.
We wrote this post to highlight the opportunities still open to you before the year ends: small wins and low-hanging fruit that make a real difference. You do not need to do everything here. Pick the ones you can realistically get done, and that will have the biggest impact on your security.
Look back at the year
A useful first step is a simple look back. Note the security events your business dealt with in 2026: phishing emails that got through, account lockouts, a supplier breach or a missing laptop. Then consider how each one came to light. Did your team spot it, or did a user, a supplier or the bank raise it?
That question is worth asking because attackers rarely announce themselves. Mandiant’s M-Trends 2026 report found that attackers spent a median of 14 days inside a network before they were discovered, up from 11 days the year before. Only 52% of intrusions were detected by the organisation’s own team. A short list of incidents is good news, as long as you are confident someone was looking.
Quick wins on identity and people
Identity is often where the quickest wins are. Most attacks we see now start with a stolen login rather than a clever exploit. It is worth checking that every user has multi-factor authentication, that admin rights still match people’s roles, and that accounts for anyone who left this year have been closed.
These gaps tend to build up quietly over a busy year. An MFA exclusion added for one project in March can easily still be there in December. Tidying them up costs little and closes the door attackers use most.
A short phishing awareness session is another easy win before the break, and it is worth including the board. NIS2 requires members of management bodies to follow cyber security training, and senior staff are increasingly targeted directly.
See what is exposed, then fix it
A scan of your public IP addresses and URLs is a quick way to see your business the way an attacker does. It shows open ports, forgotten websites and services that should not be visible from the internet, and it often turns up something worth fixing straight away.
From there, the scan gives you a ready-made to-do list. Most businesses have a system or two that slipped down the patching list during the year, such as an old server running one application or a firewall waiting on a firmware update. Patching or retiring those, starting with anything that faces the internet, is one of the most effective things you can do before January.
Check your response and recovery
If you can find an hour before the break, test a full restore from backup and walk through your incident response plan with the people named in it. Both are simple exercises, and both tend to surface small fixes, such as a backup that is not separated from the main network or a plan that names someone who has since changed role.
It is also worth asking who would see an alert at 3am on a Sunday. If the honest answer is nobody until Monday, that is useful to know as you plan for 2027.
Take stock of AI use
AI has arrived in most businesses faster than any policy could keep up. Staff use chat tools to save time, teams connect AI assistants to email, SharePoint and the CRM, and some now run AI agents that send messages, update records and move files. That is a lot of change in one year, and it makes sense to take stock.
A simple inventory is a good start: which AI tools are in use, who uses them and what they are allowed to touch. It gives you a baseline for AI governance in 2027, and it often highlights quick fixes, such as an agent with broader access than it needs.
CommSec’s AI Detection and Response (AIDR), powered by CrowdStrike (Falcon Guardian), can help with this. It gives you visibility of AI use across the business, so you can see which tools and agents are active and what they are doing. It applies data loss prevention to stop sensitive data leaving through prompts and uploads. It also controls the permissions AI agents have to perform tasks, so an agent cannot reach further than it should. AIDR feeds directly into our Managed SOC, so our analysts watch AI activity alongside everything else, around the clock. You do not need CrowdStrike on your endpoints to use it, and it is available as a standalone module. The result is the evidence you need for AI governance, and a clear answer when your board asks how AI is being used.
Make your progress easy to show
NIS2, DORA, ISO 27001 and cyber insurers all ask a version of the same question: can you show that you monitor your systems and respond to incidents? Much of the work your team did this year counts here, as long as it is written down.
In practice, the logs usually exist. Firewalls and Microsoft 365 record a great deal. What is often missing is a record that someone reviewed them and acted.
If you have budget left this year, booking your annual penetration test is one of the most useful ways to spend it. Most frameworks and insurers now ask for proof that your systems have been tested, and a recent test report gives you that proof going into 2027.
Where we can help
Looking across these areas, one theme comes up again and again. The warning signs are usually there: a sign-in from an unusual country, a new inbox forwarding rule, a server that suddenly starts scanning the network. Your tools already record them. What many teams lack is the time to watch them around the clock.
That is what 24×7 security log monitoring with managed detection and response gives you. CommSec’s Managed SOC connects to the tools you already own, including your endpoints, firewalls, Microsoft 365 and cloud platforms. Our analysts in Dublin investigate every alert, day and night, and act to contain real threats. We also scan for vulnerabilities, and each month you receive a report that is ready for your board and your auditor, with clear findings and remediation steps.
If you want a simple place to start, our end-of-year security checklist here sets out 10 checks. Pick the ones that fit your business, and go into 2027 with a clear plan.