New Year, New Mindset: Security resolutions for 2026

Security resolutions for 2026

United Kingdom, Jan 2, 2026

Practical wins for posture and peace of mind

Authored by, James Gillies, Head of Cyber Security.

The end of the holiday season marks the beginning of a new year, and with it comes commitments to change that take the form of New Year's resolutions. 

For most of us, these resolutions typically mean a new gym membership (and we're sticking to it this year), but in cyber security, our resolutions come from asking three simple questions: What did we learn? What didn't we get round to? What do we need to do this year?

What did we learn?

If 2025 taught us anything, it's that having more data doesn't automatically make you more secure. Many IT teams invested in SIEM and XDR, which gave them access to more data, but they became buried under the thousands of alerts generated by that data.

To be clear, having access to the data is an excellent step, but what does the data mean, and how will you use it? The real wins came when IT teams focused on outcomes:

  • Turning signal-to-noise
    Creating a way to identify false positives and irrelevant alerts from meaningful signals.
  • Tightening use cases
    Define clear scenarios for threat detection rather than generic, broadly applied rules.
  • Measuring maturity, not volume
    Track how well processes and detection capabilities improve over time, rather than counting alerts.

That shift reduced triage fatigue and surfaced the incidents that genuinely pose a risk.

What we didn't get round to?

No judgment from us, the "boring but brilliant" basics often slip: your incident response plan is gathering dust, crisis communications are untested, or DR is never exercised outside office hours. You're not alone; it happens. True resilience, though, comes from the disciplined application of the basics—regular testing, strong controls, and supply chain vigilance, not just advanced tools. These artefacts don't win awards, but they do win recovery time.

What do we need to do this year?

You can start with a quick posture check: a short MXDR readiness assessment (for example) gives you a strengths-and-gaps snapshot and a tailored improvement list, ideal for kicking off your roadmap without committing to a long programme.

The natural next step is to get proactive with your exposure management: map attack paths, prioritise misconfigurations by business impact, and remove the routes adversaries love before they're used. It's risk reduction with receipts!

The considerations you need to make

Do your compliance goals align with operational reality? For a policy to be truly actionable, your teams need clear steps for implementation. Backed by practical procedures and technology, policies ensure they can respond quickly and consistently in real incidents, rather than relying on documents that look good in audits.

Treat advisory and operations as a single system: advisory outputs inform the SOC, and SOC telemetry informs the next advisory sprint. That's how you close gaps and keep momentum.

What can you do right now?

Pick one resolution you can deliver in under 90 days: refresh the IR plan, run a DR night‑flight, or take a readiness self‑check and publish a simple, three‑line roadmap (now, next, later). 

Small, practical wins compound, and posture improves where it matters most.

 

Topic

Related Insights