The question is very broad - if you narrow it down to a specific area, it's a bit easier. Generally, by industry and company type, company make up (eg: peopele,

The question is very broad - if you narrow it down to a specific area, it's a bit easier. Generally, by industry and company type, company make up (eg: peopele, process, technology) will focus your directives and approach. A risk assessment, performed on the people,process,technolgoy and roles within them helps. You can narrow it down by looking at security focus for your vertical. Look at the easiest targets (generally those not requiring physical access) .... so email phishing, spoofing, and in some cases external penetration. Although external penetration is not as large a threat as many make it out to be compared to other factors.