Organizations need a culture that goes beyond reporting incidents, where the business wants to collaborate with the security team