Breaches hurt, incident management is a strategic security priority, and legal notification requirements are ramping up. But how does that translate into action, and are firms learning from mistakes?