I think "good security/engineering practices" still has a chance.

Things like--

  * Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum 
  * Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
  * Encrypting data at rest

All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.

Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched

This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title

There's a really simple solution that people will hate: server goes offline at night.

I've seen this a few times, and it's pretty annoying as a user, but ultimately it's not that bad usually. If you are ordering something at 3am, the physical shipment still occurs during daylight hours. Many banking operations are not actually instantaneous, they settle in a batch job overnight.

And this doesn't have to be binary. Providing a read-only interface provides lots of value while having a reduced attack surface.

People are gonna hate this but: we’ll need agents ready and waiting to autonomously patch and deploy instantly

A published CVE is kind of late in the game even.

low attack surface applications is the future.

23 pm is what, 11:00 am?

23 pm where? Simple answer is distributed teams.