Companies like black hills infosec have tons of free stuff. Also all the free tools like nuclei, zap, opencve, and shodan.

Best practice is still best practice. Now companies will just have to spend more money on it.