We have just begun the year. Many organizations are starting with good intentions. Cybersecurity is almost always on the list. Yet we see in practice that many companies don’t know where to start. Then they quickly talk about a firewall or a new antivirus package.
That feels safe, but in 2026, that’s rarely where you remove the most risk.
At New Yard, we see that incidents are increasingly caused by abuse of existing accounts, incorrect domain settings, outdated environments and lack of recovery options. This is why we take a different approach: no separate measures, but a clear security roadmap.
Why security often costs more than you think
When security fails, it is almost never about “a little virus.” The consequences are usually greater:
- Account takeover where someone reads along undetected
- Ransomware after silent data theft
- CEO and invoice fraud via email
- Stalled systems and lost productivity
- Reputational damage to customers and partners
A simple calculation makes this concrete:
- 80 employees
- 6 hours not productive
- an average of €30 per hour
That means €14,400 in direct labor costs, excluding lost sales and reputational damage.
What does work in 2026: six practical steps
Step 1: Implement open standards for domain and email
Many attacks start before a user logs in. Open standards such as SPF, DKIM, DMARC and DNSSEC ensure that your domain name cannot be easily abused.
The result:
- Less phishing
- Better email reliability
- Protecting your brand and reputation
By 2026, monitoring alone is no longer enough. Work controlled toward enforcement. Read more
Step 2: Get rid of wildcard certificates
Wildcard certificates seem convenient, but increase the impact when misused and make management more difficult. By deploying certificates per service or component:
- reduce your risks
- improve your overview
- better adhere to zero trust principles
Replacing certificates is the time to make this move. Read more
Step 3: Update structurally and look at EOL and EOS
Outdated software is one of the biggest security risks. Especially in virtual workstations such as Citrix, AVD, RDS or Omnissa, where many users depend on a single golden image.
Schedule set update times for:
- servers and platform components
- golden images
- network components
- clients and thin clients
Regularity prevents major interventions and unexpected disruptions. Read more
Step 4: Make password managers the default
Reused passwords remain a major risk. Password managers help by:
- enforce strong, unique passwords
- reduce support questions
- encourage secure login methods
In addition, they increase the ease of use for employees. Read more
Step 5: Back up Microsoft 365
Cloud does not automatically mean backup. Without separate backup, recovery from errors, ransomware or deletions is limited.
A Microsoft 365 backup:
- Protects Teams, SharePoint, OneDrive and Exchange
- shortens recovery time
- increases confidence in continuity
You don’t invest in storage, you invest in recoverability. Read more
Step 6: Use CIS Benchmarks as a Basis.
CIS Benchmarks provide generally recognized guidelines for setting up IT environments securely and consistently.
Important here:
- implement them in stages
- start with the virtual workplace
- document exceptions
- evaluate annually
Properly applied, this can even have a positive effect on performance and Digital Employee Experience (DEX). Read more
Common objections
“This is going to frustrate users.“
Inconsistent security frustrates. Clear, predictable choices actually provide peace of mind.
“This costs performance.“
Poorly designed measures cost performance. Standardization improves stability and DEX.
“We’ll do this later.“
Later often means during an incident, under pressure and without oversight.
Improve security without breaking your digital workplace
We combine security with Digital Employee Experience. Every measure has an impact on how people work. That is why we always look at security, stability and user experience in conjunction.
Schedule a no-obligation security roadmap consultation
Want to know what steps in your area will have the most impact in 2026, with minimal impact on users?