2014 Targeted Attacks Study offers the proverbial good news/bad news: Most organizations are doing the right things when it comes to preparing to defend against advanced threats. The majority of organizations have an internal CSIRT, and they have invested in traditional security solutions such as antivirus, intrusion prevention and encryption. The bad news: Too many of their employees are not doing right things, and as a result they are leaving their organizations open to the ravages of targeted attacks such as spear phishing, malvertising and Trojans.”]
Source: https://www.databreachtoday.com/surveys/2014-targeted-attacks-study-s-22