Raise the Floor Before You Raise the Ceiling
How to decide where proactive security effort goes when nothing is telling you what to do next. Spot your weakest capability, define "good enough," and know when to move on instead of over-optimising one area.