Companies are primarily focused on protections when instead they should be considering what to do after the systems are breached.