When resources are limited, the highest-leverage security work is rarely a new appliance. It is network segmentation — deciding, in writing, what is allowed to communicate with what, and enforcing it at the firewall.
Segmentation turns a breach into a contained incident. If a compromised workstation cannot reach the finance VLAN or the exam database, the blast radius is a single device instead of the whole campus. It also makes monitoring meaningful: traffic outside the permitted matrix is anomalous by definition.
Start with the crown jewels — the services whose downtime or exposure matters most — and segment outward from there. A few well-enforced rules beat a hundred that nobody maintains.
