Any attack against significant organizations is labeled 'sophisticated' by default. The reality is that most of these attacks result from inadequate security programs. This review of recent notable incidents will highlight the root vulnerabilities and define an adaptive security strategy to prevent incidents, but more importantly to detect and respond to such incidents before loss can be realized.