Feeling anxious, how to manage

We were hosting on Vercel because honestly it made shipping insanely fast. Small team, limited bandwidth, didn't want to spend weeks managing infra.

Then the recent security incident happened and we have enterprise clients so now we dont want to risk the hardwork we did to build this company.

Now I'm moving parts of our stack directly onto GCP and realizing how deep the rabbit hole goes. IAM, secrets, networking, service accounts, role boundaries, audit logs... feels like one wrong config and you are done with. Overwhelmed.

I want to know how people here are approaching cloud security.

What are the actual best practices that matters