Security Think Tank: No one-size-fits-all security solution

What key things should organisations be doing in terms of cyber defences to ensure they are robust/resilient?