1. Two-factor authentication enforced on everything. 2. Access control policies which minimize privileges to only those which are needed. 3. Put everything be

1. Two-factor authentication enforced on everything. 2. Access control policies which minimize privileges to only those which are needed. 3. Put everything behind corporate SSO instead of per-account passwords and login pages. 4. An authenticating proxy that enforces policies on each individual machine using something like webauthn. The first recommendation limits the extent to which accounts can be compromised if users mistakenly enter their passwords. The second limits the damage which can be done when accounts are compromised. The third limits the general attack surface of passwords entirely, as does the fourth. In particular: the fourth also allows you to remove your corporate VPN while leveraging SSO. It also makes it easier to enforce the granular access control policies. These things can be a heavy upfront technical investment, but there are off the shelf solutions and products for each of them. They're also easier than trying to train humans to be superhuman.