When security incidents strike, blame may be shared—but the burden of response always falls on the security team.