Having worked as a security and IT risk consultant for considerable time, I have to think a lot of companies must subscribe to the "any news is good news" philosophy. Many are taking unacceptable risks with sensitive customer data that will likely end up as front-page fodder.

It's not like they don't have security strategies or aren't taking steps to meet regulatory requirements. Organizations stumble when they assume certain solutions provide greater levels of security than they actually do, or that certain processes are immune to security breaches. These assumptions lead to what I call "gotcha moments" that often result in data leaks and negative publicity.