@Darrenpauli focus on config. SSO or password mgr, MFA + basic device hygiene. The best money spent would be a health check for config of office productivity and accounting software, and review of payments process.