PREVENTION IS THE WEAKEST LINK
NIST CSF function scores. Strong at policy( Govern) and reaction( Respond), weak at prevention( Protect).
Organizations aren ' t disengaged, they ' re reactive. They score highest on the functions that bookend an incident, Govern( setting policy) and Respond( reacting once it happens), and lowest on Protect, the prevention in between. They can set the strategy and clean up afterward, but not stop the incident in the first place.
No one is immune; the gap persists across industry, geography, and budget. Even financial services, the strongest sector across almost every other function, lags on prevention. You can ' t respond your way out of exposure that grows faster than you can reduce it.
19