Organizations that wait for industry security standards to fully mature or for a breach to force their hand will find themselves at a disadvantage with regulators, customers and insurers.