By focusing on the “where” or “who,” organizations can often end up neglecting to analyze the nature of past attacks and discover the lessons that can be learned from them.