(Which lesson can be learned from organizations that experience breaches due to poor cryptographic practices?

Breaches tied to poor cryptographic practices often stem from preventable issues: outdated algorithms, weak key management, misconfigured TLS, missing integrity checks, hard-coded secrets, unrotated keys, or improper certificate validation. A key lesson is that organizations must proactively identify and prioritize these risks—exactly what comprehensive risk assessments are designed to do. Effective risk assessment inventories cryptographic assets (keys, certificates, protocols), maps them to business processes, evaluates threats (e.g., MITM, data exfiltration, supply-chain tampering), and finds gaps between current controls and best practices. It also helps ensure crypto decisions align with real-world risk, compliance requirements, and operational constraints. The other options are explicitly wrong: training is relevant because many crypto failures are implementation/configuration errors; audits and updates are essential because cryptographic guidance evolves; and security cannot be “secondary” without increasing breach likelihood and impact. Therefore, the most defensible lesson is that comprehensive risk assessments are vital for identifying vulnerabilities before attackers exploit them.