There is no single answer for every organisation. Current breach research makes vulnerability exploitation, third-party exposure, and unapproved use of AI tools important concerns. In a specific estate, however, the most material risk may be an unsupported platform, overprivileged access, a vulnerable application, an exposed backup, or a recovery process that has not been tested.