In taking great pains to protect confidentiality and limit litigation risk in data breach investigations, lawyers actually are making cybersecurity worse, according to new research that examines how privilege concerns are hindering companies from learning the root causes of data breaches and preventing future cyberattacks.

Incident response should help companies learn from intrusions and mitigate data breaches. But these efforts have fallen short, researchers found. And despite the rise of a robust cyberinsurance industry, the cybersecurity community remains in the dark about what goes wrong.