Three Ways Organizations Can Improve Their Cybersecurity Posture Without Spending Money

Are there some things organizations need to stop doing to improve their cybersecurity posture?