15 from 15: Blocking and Tackling Cybersecurity & Resilience
Guest post by Andy Jabbour, Gate 15
Cybersecurity can get complicated quickly. New threats. New technologies. Artificial intelligence. Ransomware. Vulnerabilities. Nation-state actors. New products promising to solve the latest problem.
But some of the most effective things organizations can do to reduce risk aren’t new or complicated at all.
They’re the fundamentals.
Gate 15’s new white paper, 15 from 15: Cybersecurity Mitigation & Resilience Fundamentals, identifies fifteen practical areas organizations can focus on to improve cybersecurity, preparedness, and resilience. The concepts are straightforward. Executing them consistently—and doing them well—is harder.
As Gate 15 Founder & CEO Andy Jabbour explains in the paper:
Blocking and Tackling
When I played high school football, I was a lineman. I played offensive and defensive line, and much of the job came down to the fundamentals of blocking and tackling. The ideas are not complicated. Executing them consistently, under pressure, against someone determined to beat you, is much more difficult. For all the excitement of the game, the teams that are best at the fundamentals usually give themselves the best chance to win.
That idea has stayed with me through powerlifting, the Army, and more than twenty years working in security and resilience. Gate 15 is a blocking-and-tackling company.
We spend every day studying evolving cyber threats, ransomware and extortion, artificial intelligence, exploited vulnerabilities, insider risks, supply-chain compromises, operational technology concerns, geopolitical tensions, and the broader all-hazards environment. We also see an endless stream of technologies and products promising to solve the latest problem.
Some are excellent. Some are… not excellent.
None eliminate the need to execute the fundamentals.
Our team helped develop and subsequently refresh WaterISAC’s Cybersecurity Fundamentals for Water and Wastewater Utilities. And throughout 2026, we’ve taken this broader message on the road—from the TribalHub Cybersecurity Summit in Jacksonville to TribalHub regional events around the country.
The message has remained remarkably consistent:understand the threats, but don’t become overwhelmed by them. Focus on risk. Focus on impact. Focus on practical mitigation and resilience.
That’s 15 from 15.
The 15
If you do nothing else, start here. Review these fifteen areas honestly. Identify where your organization is strong, where it is weak, and where one practical improvement could meaningfully reduce risk.
Then act. Then keep going.
You don’t need to become championship-caliber in every area tomorrow. Break the work into manageable pieces, establish priorities, and get a little better every day.
Assess – Know where you are so you can build a realistic path to where you want to be.
People – Make security everybody’s business, from every user to the CEO.
Organizational Culture – Make security, safety, and resilience part of how the organization operates.
Security Stack – Build layered, best-practice security capabilities – and actually operate what you buy.
Information Sharing – Join trusted communities, participate, contribute, and learn from your peers.
Multi-Factor Authentication (MFA) – MFA all the things, then keep moving toward stronger, phishing-resistant methods.
Network Segmentation – Separate what should not talk, control what must, and build an architecture you can support.
Patching – Know it, prioritize it, patch it – or mitigate it – at the speed of risk.
Backups & Encryption – Protect the data and make sure you can recover the business.
Planning – Build executable plans before the crisis and keep them current.
Out-of-Band (OOB) Communications – Know where to communicate when normal communications are unavailable or untrusted.
Train – Plans and tools do not execute themselves. Train the people.
Test – Validate that systems, controls, procedures, and capabilities actually work.
Exercise – Put the team on the field and practice before game day.
Post-Mortems – Learn from everything, document it, improve, and do it again.
Understand the Threats.
Assess the Risks.
Take Action.
Cyber and all-hazards risk and resilience. At Gate 15 we apply a threat-informed& risk-basedapproach to analysis, resilience, & operations, helping to secure America’s People, Places, Data, & Dollars. Learn more www.gate15.global. Join Gate 15’s Resilience and Intelligence Portal(GRIP) and connect to our homeland security community. Join the GRIP!