Chief Information Security Officers (CISOs) were surveyed on their security programs and risk management strategies, including attack response times.