gadgets vs. process innovations

In the 1980s, defenders had to invent computer emergency response teams. In the 1990s, it was an innovation to have a chief information security officer to centralize authority or build an information sharing and analysis center to share and collaborate with peers. In the 2010s, the idea of a cyber kill chain changed how defenders conceptualize their job. Further improving operational coordination―through response playbooks, frequent exercises, and groups like information sharing and analysis organizations―can be an inexpensive way to build significant capability. Such revolutionary innovations have a very modest cost yet are often overlooked in favor of the newest technological gadgets.

from: Building a Defensible Cyberspace