In our experience, five issues appear in almost every engagement: over-privileged service accounts, missing MFA on remote access, unpatched edge devices, secrets committed to repositories and flat internal networks.
None of them require a huge budget to fix — they require ownership. Assign each finding an owner, a deadline and a verification test, and you remove the majority of real-world risk before an attacker ever shows up.