Start at the fundamentals, dammit! Do you have off-site backups of all your critical data on a regular schedule? Do you have physical 2FA on all your accounts

Start at the fundamentals, dammit! Do you have off-site backups of all your critical data on a regular schedule? Do you have physical 2FA on all your accounts? Are you actively patching/updating all your devices on a schedule, and actively discarding the devices that are too old to patch? Only after these are done should you start looking at complex phishing and social engineering scenarios. You can successfully mitigate everything you are worried about by nailing these fundamentals.