Working in Cybersecurity I have often asked myself this question. We spend so much time convincing each other that cybersecurity is a massive risk, when I often

Working in Cybersecurity I have often asked myself this question. We spend so much time convincing each other that cybersecurity is a massive risk, when I often feel like we spend more time talking about it than actually fixing cyber incidents. Now of course there is an element of being proactive as opposed to reactive. If businesses do basic business business continuity they will actually know what the impacts of losing access to their systems or data are. And will quite easily be able to understand the risks and impacts associated with losing a key system completely, or for a duration of time and whether the business can tolerate it. From my experience in the last couple of the years, the largest threat has been ransomware attacks. These attacks have seen the largest real impact to the operations of some large organisations, essentially taking their systems offline. The other point is that companies don't want to announce they have had a cyber incident and perhaps these organisations have had appropriate mitigating controls in place to protect their environment, despite detecting an attack. Which reminds me of the old saying where IT do less work when they're doing their jobs correctly. My final note would be, these "bean counters" will have a hard time explaining themselves when their key applications are completely encrypted, having not invested in additional DR infrastructure to protect themselves. I have seen many times where the cybersecurity budget has magically increased following a cyber security incident.