We keep reading how spending on cyber security is constantly increasing, there are more jobs in the field than ever before, more products, more AI, more buzzwords and... more breaches.With renewed interested in 'doing the basics' we probably need to agree what the basics actually are. How do you scale these in enterprise environments? Are they really worth the effort? This talk takes a look at what some of the most common mistakes are that organisations make when it comes to security. From understanding risk to some basic threat modelling and layering security controls, a few simple things go a long way.