When we look back across the businesses we assess, a striking share of what we flag can be put right in under ten minutes. Not the deep, structural work - that takes longer and costs more - but the settings, the toggles and the forgotten accounts. These are not the most impressive findings. They are, however, the ones most likely to still be fixed a month later.

There is a pattern behind that. A fix that takes ten minutes gets done on the day, while the phone is in the person's hand. A fix that needs a project, a budget and three people's agreement gets written down, admired, and quietly deferred. So the cheap findings punch above their weight, not because they matter more in theory, but because they actually happen.

The usual quick wins are familiar: turning on a second sign-in step, removing a leaver who still has access, switching on a backup that was sitting there unused, setting a passcode on a shared device. Each one closes a real door. None of them needs a purchase order or a specialist.

We are wary of pretending this is the whole picture. Some risks genuinely need time and money, and telling a business otherwise would be dishonest. But we have learned to lead with the ten-minute list, because momentum is real. A business that fixes four small things this week is far more likely to tackle the larger one next month.

The lesson we take from our own data is to make the easy things easier still. Every quick fix we can turn into a single, obvious step is a fix that will actually get made, by a busy person, on an ordinary Tuesday, and stay made.