Although security leaders cannot anticipate every new threat, there are ways to mitigate risk and establish resilience against attacks.