What should I do first to improve my security?

The answer

Protect your email. Many other services use it for password recovery, so start with a unique password and two-factor authentication there.

Start with email. It can often reset passwords for other services, so losing the account can lead to the loss of several others.

Stop reusing the same password. A password manager can remember unique passwords for you, and your browser already includes one.

Then check the router. Turn on updates, turn off remote management and change the admin password if it is still the factory default.

Finally, put smart devices on a separate network. They will not be able to reach your computers and phones directly.

These four changes use the devices and services you already have and need no new security subscription.