Imagine an undeclared cyber war broke out. Out of curiosity, how 'far' from being able to defend themselves are most serious companies? If they had 3 months to

Imagine an undeclared cyber war broke out. Out of curiosity, how 'far' from being able to defend themselves are most serious companies? If they had 3 months to prepare, do they save themselves from getting breached without going offline?