It's not exactly fair because security is a process. Even following all best practices, new attacks happen all the time. Sometimes the security process includes

It's not exactly fair because security is a process. Even following all best practices, new attacks happen all the time. Sometimes the security process includes post-attack investigation and mitigation. It's quite easy to point a finger when you have a few servers that you spend all of your time securing and monitoring. It's something else when you have departments of people connected to your network and running services, breaking policies, taking laptops out of the office, etc. Nobody wants to see their data being breached. I applaud companies for publicly sharing their investigation and response.