  In this short paper we argue that to combat APTs, organizations need a
strategic level shift away from a traditional prevention centered approach to
that of a response centered one. Drawing on the information warfare (IW)
paradigm in military studies, and using Dynamic Capability Theory (DCT), this
research examines the applicability of IW capabilities in the corporate domain.
We propose a research framework to argue that conventional prevention centred
response capabilities; such as incident response capabilities and IW centred
security capabilities can be integrated into IW enabled dynamic response
capabilities that improve enterprise security performance.
