There is a wealth of information security guidance available in academic and practitioner literature. Although other tactics such as deterrence, deception, detection, and reaction are possible, most of the research focuses on how to prevent security threats using technological countermeasures. The findings of a qualitative study conducted in Korea to determine how businesses use security techniques to protect their information systems are presented in this article. The results show a deeply ingrained preventative mindset, driven by a desire to ensure the availability of technology and services and a general lack of awareness of enterprise security concerns. While other tactics were evident, they were also preventative measures. The article lays out a research agenda for deploying multiple strategies across an enterprise, focusing on how to combine, balance, and optimize systems. This research looked at various topics, including information security and areas where security strategy is likely to be discussed, such as military sources. There are nine security strategies identified. A qualitative focus group approach is used to determine how these security strategies are used in organizations. In focus groups, security managers from eight organizations were asked to discuss their organizations' security strategies. According to the findings, many organizations use a preventive approach to keep technology services available. Some of the other identified methods were used to support the prevention strategy on an operational level.