Prioritize Threat Assessment, Not Compliance

Security is about threat assessment and response much more than compliance, Potter said, though the later will come if businesses are doing things right.

In an IoT world, businesses must ensure that hackers can't get into their network using smart devices. 

Before provisioning new devices, companies must therefore know where the information is going to come from and how it's going to land on the network.

Few companies Potter has observed have a cohesive security gameplan. Many of the pieces and parts of the strategy are present, he said, but departments are often too focused on protecting their sacred cows to the detriment of the overall strategy. 

"You have to kill your darlings," Potter said.