Is Defender actually on?
Check that Defender, the firewall and Windows Update are really running, not just showing a green check mark.
Close the risky doors
Find the admin accounts and remote access tools that shouldn't be there, before someone else does.
Don't get locked out
Make sure you can actually find your BitLocker recovery key before you ever need it.