Survey on incident responses preparedness shows 39% of firms still have no processes in place to deal with security incidents.