Which cybersecurity attack is currently your highest priority (to defend against)?

Attacks are a symptom. Attack vectors are more important to identify. As an example; Your choices of Ransomware, Cloud security incidents or even 3rd party vendor compromise, the attack vectors is 'identity compromise'. Identity compromise can happen via insecure account credentials, loss of API keys and secrets, session cookies ,  tokens or inadequate use of OTPs. Now if I flip your question to read, 
"Which cyber security attack vector is your highest priority?" 
I would answer in below order of priority:

1. Credentials / identity loss of web facing applications ( missing SSO/PAM integration).
2. Patchable vulnerabilities exploitation of web facing applications and endpoint desktops. (Broken / insufficient patch management process)
3. Compromised credentials on admin endpoints (Inadequately configured EDR and missing least privilege access user account on privileged user endpoints, making them susceptible to phishing attacks).