The third lesson is to understand the limits of your security systems. Don’t expect your antivirus to spot custom malware, and use vulnerability scanners only as a secondary test. Review third-party systems and don’t miss low-hanging fruit such as changing default passwords. Be aware that bad incident response can be worse than none at all, says Neohapsis’ Greg Shipley, Tyler Allison, and Tom Wabiszczewicz work in Neohapis’ Chicago office.”]
Source: https://www.darkreading.com/attacks-breaches/5-security-lessons-from-real-world-data-breaches