The ways in which criminals are attacking us are changing constantly, in a cycle of new method — defense — new method — defense, and so on. If an organization is not able to adapt at speed, it is (at speed) becoming vulnerable and an easy target.
Similarly, an organization needs to be able to detect attacks, especially attacks using a new method, if it is to respond, limit the damage and harden its defenses.
Few organizations can do all of this with only internal resources. Every sane organization should partner with specialized organizations that have the ability to monitor what new attacks are being used now or will be soon, and then help the company respond with new defenses.