NetworkWorld says the study included over 500 forensic investigations and found 63% of those companies didn't find out about the breach for months and 70% of the breaches were discovered by third parties. There are more statistics in the article which is worth reading in it entirety but most stinging are:

the study says that companies fail to actually enact their established security policies. The study also notes that 83% of all network attacks are not difficult attacks to thwart, and the 85% are opportunistic attacks that are not directed against a particular entity but are rather initiated randomly through techniques such as phishing. What's more, the study finds that evidence of 82% of all breaches studied is available to the victims but that this evidence is not noticed or acted upon.

and then recommends:

that enterprises concentrate on enforcing the basics of data security - such as actively monitoring data logs and creating data retention plans - before they take extra precautions against sophisticated hacking or malware assaults.

We need to learn to walk before we run. For more on this theme, see recent posts on ignoring warnings about malware, poor security practices with smarthphones, and inconsistent use of encryption.