The Verizon Data Breach Report consistently says that most malicious intrusions could have been noticed earlier. Most of the places I review have hideous event log management. Most places think they have rock-solid patching only to discover that most common browser add-ins aren’t patched. It’s also important to ask if the people in charge of particular computers if they understand the reason for each of the installed programs and services. The average security review lasts from one to four weeks, depending on the scope and details required.”]
Source: https://www.csoonline.com/article/2617791/secure-or-not–10-spot-checks-will-tell-you.html