ESG developed a scoring system that segmented the APT survey respondents into three types of organizations: Most prepared for APTs (21% of the total survey population) Most prepared organizations have a strong culture of security awareness as part of IT and business processes. CISOs want to know the organizations security posture at all times so they tend to use a lot of metrics as well. These firms are also the most paranoid; they actively look for things they missed or hire 3rd parties to do so.”]
Source: https://www.csoonline.com/article/2221342/apts—unfortunately–there-is-no-silver-bullet-solution.html