This is where I would find fault with Sony - not in the breach itself, but in not detecting it quickly, and failing to prevent the exfiltration of large amounts of data," says Rick Holland, a security and risk management analyst at Forrester Research.