Is it time to stop blaming organisations for being breached?

The IT security industry needs to look at itself and its practices before blaming organisations that have been hit by cyber attacks