Here are five reasons businesses fall short, according to cybersecurity experts.

• 

  You’re not patching fast enough.

  Businesses can’t prevent every cyberattack. Most corporate networks are too large, with too many opportunities for attackers to breach them. But you leave your network open to needless attacks if you fail to implement even the basics of network architecture security properly.
  It’s important to put strong protocols in place to make sure all software is updated and patched in a timely manner. You should also know where your critical data resides on your network and how big the network is.
  If you haven’t installed a new patch and the next email someone in your company receives is from the bad guys, a phishing email with a nasty attachment. you could have a zero-day exploit on your hands, Rosenblatt says. And that compromise could spread throughout your network.
  Hewlett Packard Enterprise (HPE) is an exclusive silicon root of trust and Aruba Policy Enforcement Firewall recognized for its ability to reduce cybersecurity risk with the new Marsh Cyber Catalyst designation.
  Cyber Catalyst is Marsh’s new cybersecurity evaluation program that enables customers that adopt designated technologies to be considered for enhanced terms and conditions on cyber insurance policies from participating insurers.

• 

  You lost track of your critical data.

  Smart companies realize they should align their security strategy to better protect the organization’s most critical asset: data. That requires a good understanding of where your most critical data resides and who touches it, says Kerry Bailey, CEO of eSentire, a managed detection and response provider.
  It’s particularly important to know the defensive capabilities of your enterprise network and where your data is and the risk associated with it, says Bailey. “The other part is companies now tend to work with many third-party vendors that develop apps or provide services, and you need to have a good understanding of what they are doing [on your network],” Bailey adds.
  Also part of good data protection management is keeping a close eye on enterprise endpoints. Attackers increasingly look for new ways to break into your network and execute code. Using solutions that monitor continuously for anomalous behavior across the enterprise is vital to identify potential attacks.
  In terms of data protection for enterprise endpoint Hewlett Packard Enterprise (HPE) Cyber Catalyst enables customers that adopt designated technologies to be considered for enhanced terms and conditions on cyber insurance policies from participating insurers.

• 

  You rely too much on antivirus software.

  Relying solely on security at the network perimeter is risky. You may have a firewall, but email is an open doorway into your business.
  Cybercriminals are just one successful phishing email away from access to your valuable data. Phishing attacks bypass most corporate cybersecurity defenses. It takes just one person to click on the wrong link or open an attachment they shouldn’t.
  While the average malicious file shows up in most antivirus programs on the market, if your software doesn’t detect it, you could be in trouble. Not all antivirus software programs are created equal, Rosenblatt points out. One antivirus application might have a higher detection rate, while another might be better at blocking attacks.
  A solution is to mandate that your enterprise’s mail system does not accept any executable files (ones that commonly have an .exe file extension, typically the source of cyberattacks). Although blocking executable files can be an inconvenience, in the end, it makes your network more secure. There are lots of other ways to get documents into an organization, Rosenblatt notes. For example, each user or employee can make individual arrangements with the sender to receive documents via Dropbox.

• 

  You don’t foster a culture of cybersecurity awareness

  Although many cyberattacks that hit the news headlines involve large well-known names, it’s wrong to assume your modestly sized business won’t be the target of an attack. In reality, cyberattackers are looking to penetrate networks in every sector of the economy.
  The best way to ensure your enterprise’s security is to create a culture of cybersecurity awareness. Every employee should be aware of the threats and take pride in preventing cyberattacks. It’s important to encourage company leadership to treat cybersecurity as a business priority, says Sean Blenkhorn, eSentire’s field CTO.
  Best practices include:
  Keep informed about the latest threats. It’s better to know about the dangers and do something rather than be uninformed and hope you’ll be OK.
  Understand acceptable risk. You can’t eliminate every risk, but you can reduce risk to an acceptable level.
  Communicate well. This includes both formal communication and informal communication with employees.
  Celebrate successes, especially any thwarted attacks.
  The company’s business leaders and broader employee base likely don’t need to know all the technical details around cybersecurity, but they do need to know enough about the potential threats to help thwart any attacks or formulate sufficient resource planning to deal with a possible attack. This can be achieved through training sessions and educational seminars to teach everyone in the company, from the C-suite to the reception desk, how to identify threats and prevent them from happening in the first place.

• 

  You haven’t accepted the inevitable: You will be hacked.

  Finally, companies just need to accept that they’ll be hacked eventually, says Blenkhorn. The key is making sure you have a plan to respond when it eventually happens. A cybersecurity incident response plan with a clear role for each person involved is vital, and it can help an enterprise get back on its feet more quickly.
  Companies need to place security at the center of their business operations, says eSentire’s Bailey. If your company network is damaged and goes offline for a few days, the cost can be significant.
  Hewlett Packard Enterprise provides future-oriented security services which will help you to protect your enterprise against new vulnerabilities and keep aware of evolving security, regulatory requirements.