Run the detection and response that catches the attacker before the incident matters. Depth, not headcount.
What this covers. Six lines, then we talk.