Following conversations with leading security professionals, I have distilled advice for organizations looking to increase attack resistance without increasing spend.