Businesses of all sizes can begin to create a cyberattack response and prevention plan by first identifying vulnerabilities. IT and security departments should run regular incident tests to identify weaknesses and strengthen the security program. Go beyond checking to make sure that software is up to date, although this is also important because most companies are way behind on security patch updates. Realistically prepare for the fallout of an attack by creating faux incident scenarios and run them through the organization in order to critique shortcomings and identify areas for cybersecurity improvement.