What are the first two lines of defense a company should take when addressing security risks?

People first, technology second

Explanation: A research work suggested that a greater focus on people, not just technology, gives functional managers control to acquire the best talent, develop the right skills, and keep employees engaged and feeling accountable for their work and how they impact your company's success. So people first and technology second is really a good idea, besides, the technologies were invented by people who chose to develop their skill (s).