If an organization is going to successfully protect its data, it must aim for preventing a breach, not passing an audit.