Firewalls, endpoint protection, email filtering, and multi-factor authentication configured properly and reviewed on a schedule rather than set up once and forgotten.
We monitor for the things that matter, keep an incident response plan you have actually read, and test restores so backups are more than a checkbox.