In the past, security professionals tended to focus most of their efforts on the prevention side of the street. CISOs must prepare for the worst and assume that cyber adversaries will circumvent their castles, gates, and moats. ESG research found that a typical enterprise organization spends about 67% of its resources on prevention and the remaining one-third on detection/response. This has caused some in the industry to declare that incident prevention is essentially dead Some say its time to move on from incident prevention and invest heavily on the detection and response front.”]
Source: https://www.csoonline.com/article/2360729/advanced-prevention-nothing-new-just-better.html