About the only commercially available solution that provides defense against attackers with more than $1-10M is a system that is inaccessible to a remote attack

About the only commercially available solution that provides defense against attackers with more than $1-10M is a system that is inaccessible to a remote attacker. As a company this means complete physical disconnection of the systems you want to use in addition to a complete removal of all possible connectors except for a very limited set of explicitly enumerated entry points that you add back onto a system that is completely physically disconnected. To evaluate the quality of your security, you should hire a red team, a team that emulates an attacker, to attempt to breach your security. If they are able to breach your systems then the key takeaway is that your security process is systemically incapable of defending against attackers with that level of budget and resources which is supported by the empirical evidence that a team with that level of budget and resources did, in fact, breach your systems. This is in contrast to the standard takeaway which is to just fix the specific defects discovered since obviously the only defects that exist are specifically in the areas that were probed. To actually remediate the problem you need a systemic overhaul otherwise you will just keep getting the same quality of output that is equally defective. Unfortunately, the prevailing state of cybersecurity has no functional solutions to these problems once you get to attackers with a few million dollars outside of the heavy-handed and highly inconvenient solution of disconnection. For systems with safety standards, that is a cost that should be paid. For any other system, you need to evaluate if disconnection is worth it in the context that there is a 100% chance that anybody with a few million dollars can successfully completely compromise your systems. If you only consider direct harms such as monetary damages, disruption of business, stock price changes, it is highly unlikely to be worth it compared to getting insurance at this time as most attacks that do direct harm are still being done by financially unsophisticated attackers who are still underutilizing their blackmail potential by at least 10-100x, so it is almost always financially prudent to just eat the cost. As for indirect effects, it is up to you to consider if IP loss, reputation loss, leakage of confidential information, etc. at the cost of a few million dollars is worse than the negative effects of disconnecting.