The Breach That Rewrote the Rules of Computer Security

In February 2024, Change Healthcare — one of the largest health payment processors in the United States — suffered a ransomware attack that disrupted claims processing for hospitals, pharmacies, and clinics across the country. UnitedHealth Group, its parent company, disclosed in its SEC filing that the breach affected the data of roughly 100 million individuals. The attack vector? Compromised credentials on a remote access portal that lacked multi-factor authentication.

That single failure in computer security cascaded into billions of dollars in damages, weeks of healthcare disruption, and one of the largest data breaches in U.S. history. And it was entirely preventable.

This post isn't about abstract theory. It's about what actually works to protect your organization's computers, data, and people right now in 2025. I've spent years watching companies get breached for the same avoidable reasons, and I'm going to walk you through the specific strategies that separate resilient organizations from tomorrow's headlines.

Why Most Computer Security Strategies Fail

Here's what I've seen over and over: organizations treat computer security as a product you buy rather than a practice you build. They install a firewall, deploy antivirus, and assume they're covered. Then a single phishing email bypasses every technical control because an employee clicked a link and entered their credentials on a spoofed login page.

The 2024 Verizon Data Breach Investigations Report found that 68% of breaches involved a human element — social engineering, errors, or misuse of credentials. That number has barely budged in years. Technical controls alone don't solve a human problem.

The other failure I see constantly is what I call "checkbox security." Companies implement controls to pass an audit or satisfy a compliance framework, but they never test whether those controls actually stop an attacker. Compliance is not security. I've seen PCI-compliant organizations get breached, HIPAA-compliant healthcare providers lose millions of records, and SOC 2-certified vendors become the entry point for supply chain attacks.

The Credential Theft Epidemic

Credential theft is the single most common way threat actors gain initial access to systems. Stolen usernames and passwords are sold on dark web marketplaces for dollars. The FBI's Internet Crime Complaint Center (IC3) 2024 report documented over $16 billion in reported cybercrime losses — a record — with phishing and credential-based attacks dominating the complaint categories.

If your organization relies on passwords alone to protect anything, your computer security posture is fundamentally broken. Full stop.

The Real Computer Security Stack That Works

Forget the vendor pitches. Here's the layered approach that actually reduces your risk based on what I've seen work in real environments.

1. Multi-Factor Authentication Everywhere

MFA is the single highest-impact control you can deploy. The Change Healthcare breach happened because a remote access system didn't have it. Microsoft has stated publicly that MFA blocks 99.9% of automated credential attacks.

Deploy MFA on every externally facing system, every email account, every VPN, and every administrative console. Prioritize phishing-resistant MFA like FIDO2 hardware keys over SMS-based codes. SIM-swapping attacks have made SMS verification a weak link.

2. Security Awareness Training That Changes Behavior

Annual compliance videos don't work. I've seen organizations where 100% of employees completed their annual training — and 30% still clicked a phishing simulation link the following week. The training didn't change behavior because it wasn't designed to.

Effective security awareness requires ongoing engagement, realistic phishing simulations, and immediate feedback when someone falls for a test. Our cybersecurity awareness training program is built around this principle — short, practical lessons that employees actually retain, delivered consistently throughout the year.

For organizations that want to go deeper on the phishing threat specifically, our phishing awareness training for organizations includes simulated attacks, reporting workflows, and metrics that show you exactly where your human risk sits.

3. Zero Trust Architecture

The old model — hard perimeter, soft interior — died years ago. Zero trust assumes breach. Every access request is verified regardless of where it originates. NIST Special Publication 800-207 provides the framework, and it's worth reading directly.

In practice, zero trust means: verify identity continuously, enforce least-privilege access, segment your network so a breach in one area doesn't give access to everything, and log every access decision for later analysis. It's not a product you buy. It's an architecture you implement piece by piece.

4. Endpoint Detection and Response

Traditional antivirus is signature-based — it catches known threats. Modern EDR tools use behavioral analysis to detect anomalies that signature-based tools miss entirely. If your organization still relies solely on legacy antivirus, you're fighting 2025 threats with 2005 technology.

Deploy EDR on every endpoint, including servers. Ensure logs feed into a centralized SIEM or managed detection and response (MDR) service. Detection speed matters: the Verizon DBIR consistently shows that breaches where the attacker has days or weeks of dwell time cause exponentially more damage than those caught in hours.

5. Patch Management Without Excuses

I know. Patching is boring. It's also one of the most effective controls in existence. CISA maintains a Known Exploited Vulnerabilities (KEV) catalog that lists vulnerabilities actively being used by threat actors in the wild. If a vulnerability appears on that list and you haven't patched it, you've given attackers an open invitation.

Automate patching where possible. For systems that can't be patched immediately — legacy applications, operational technology — implement compensating controls like network segmentation and enhanced monitoring.

What Is the Most Important Part of Computer Security?

If I had to pick one element that matters most for computer security, it's the human layer. Every technical control can be bypassed if an employee hands over their credentials, approves a fraudulent MFA prompt, or opens a malicious attachment. Social engineering exploits trust, urgency, and authority — and it works against even technically sophisticated people.

That's why security awareness training isn't optional. It's foundational. The best firewall in the world can't stop a legitimate user from logging into a phishing site and entering their password. Only training, combined with phishing simulations that build pattern recognition, can address that gap.

Ransomware in 2025: The Threat That Won't Quit

Ransomware gangs have evolved dramatically. Double extortion — encrypting data and threatening to leak it — is now the baseline. Some groups have moved to triple extortion, adding DDoS attacks or contacting victims' customers directly to pressure payment.

The MOVEit Transfer vulnerability exploited by the Cl0p ransomware group in 2023 affected over 2,600 organizations and exposed data on more than 77 million individuals. That attack didn't even deploy traditional ransomware — Cl0p simply stole data and demanded payment not to publish it. The line between ransomware and data extortion continues to blur.

Your defense against ransomware isn't just backups (though tested, offline backups are critical). It's the full stack: patching, MFA, endpoint detection, network segmentation, and trained employees who recognize the phishing emails that deliver initial access.

Incident Response: Plan Before You Need It

I've worked with organizations that discovered they had no incident response plan during an active breach. The chaos is devastating. People don't know who to call, who has authority to take systems offline, or whether they're legally required to notify regulators.

Build your incident response plan now. Test it with tabletop exercises at least twice a year. Include legal counsel, communications, IT, and executive leadership. Know your notification obligations under state breach notification laws, HIPAA, PCI DSS, or whatever frameworks apply to your industry.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's 2024 Cost of a Data Breach Report found the global average cost of a data breach reached $4.88 million — the highest figure ever recorded. Organizations with security AI and automation deployed saved an average of $2.22 million per breach compared to those without.

But here's the number that should keep you up at night: organizations that identified a breach in under 200 days spent significantly less than those that took longer. Speed of detection and response is a direct financial lever. Every day an attacker sits undetected in your environment, the cost climbs.

This is why investment in detection capabilities, trained personnel, and — critically — employees who know how to spot and report suspicious activity makes a measurable financial difference. The ROI on comprehensive cybersecurity awareness training isn't theoretical. It's calculable in avoided breach costs, reduced insurance premiums, and faster incident response.

Building a Computer Security Culture That Lasts

Technical controls degrade over time. Configurations drift. New systems get deployed without proper hardening. People get hired and never receive security onboarding. The only thing that sustains your defenses is culture.

A real security culture means:

  • Leadership models the behavior. If executives bypass MFA or use personal email for business, everyone notices.
  • Reporting is rewarded. Employees who report suspicious emails or potential incidents should be thanked, not questioned about why they almost clicked.
  • Security is part of onboarding. Every new hire completes phishing awareness training in their first week — before they get access to production systems.
  • Metrics are tracked and shared. Phishing simulation click rates, time to patch, MFA adoption rates — measure them and make them visible.
  • Continuous improvement is expected. After every incident or near-miss, run a blameless retrospective and implement changes.

Small Organizations Aren't Exempt

I hear it constantly: "We're too small to be a target." The data says otherwise. The Verizon DBIR consistently shows that small businesses are disproportionately targeted relative to their resources. Threat actors know that small organizations often lack dedicated security staff, use outdated systems, and skip basic controls like MFA.

If you're a small business, the good news is that the highest-impact controls — MFA, patching, security awareness training, and proper backups — don't require a Fortune 500 budget. They require discipline and consistency.

Your 90-Day Computer Security Action Plan

Stop reading advice and start executing. Here's what you should accomplish in the next 90 days:

  • Days 1-14: Audit MFA coverage. Deploy it on every externally accessible system and every admin account. No exceptions.
  • Days 15-30: Launch a phishing simulation baseline. Measure your current click rate before any training begins. You need a number to improve against.
  • Days 31-60: Enroll all employees in ongoing cybersecurity awareness training. Pair it with monthly phishing simulations.
  • Days 31-60: Review your patch management process. Cross-reference your vulnerability scan results against CISA's KEV catalog. Remediate anything on that list immediately.
  • Days 61-90: Write or update your incident response plan. Run a tabletop exercise with your leadership team. Identify your biggest gaps and assign owners.

None of this is glamorous. None of it will generate a press release. But in my experience, the organizations that do these five things consistently are the ones that avoid becoming the next cautionary tale.

Computer security in 2025 isn't about having the most sophisticated tools or the biggest budget. It's about executing the fundamentals relentlessly — and making sure every person in your organization understands they're part of the defense.