The obvious first step is to outsource all IT infrastructure to one of the large service providers. While it's possible that they'll be breached, at least they have the resources and expertise to stand a fighting chance against the new wave of advanced persistent threats. Smaller companies outside the tech sector will never be able to keep up and secure their own systems. Like can you imagine some random manufacturing company hiring enough real security experts to keep up on their own? Even if they were willing to pay there around enough of those employees to go around. (I mean real security domain experts, not compliance process box checkers.)

It's unfortunate that every business now has to pay what effectively amounts to an IT security tax which will further enrich a small set of large tech companies. But that is our reality and there's no point in pretending otherwise.