Most breaches don't come from exotic zero-days — they come from boring gaps: a leaked token, an over-permissioned role, a dependency nobody patched. Close the boring gaps first.
Identity is the perimeter. Enforce SSO and MFA, scope service accounts to least privilege, and rotate secrets automatically. A secret in an environment variable that never rotates is a future incident with a date on it.
Then make the safe path the easy path: a secrets manager wired into CI, dependency scanning that blocks risky merges, and infrastructure-as-code so every environment is reviewable and reproducible. Security that relies on people remembering will fail on the busy day.
Finally, assume something will get through. Centralised logging, sensible alerting, and a one-page incident runbook turn a 3am scramble into a rehearsed response. You can't prevent every event, but you can make sure you see it and recover fast.