"Since the phishing incident we know we are flying blind."
A security baseline with Defender, MFA and Conditional Access, plus continuous monitoring and regular reviews. Gaps get closed before they get expensive – and you see in black and white where you stand.