The challenge is that chief executives, boards and audit committees set a tolerance to risk, like they do with all other risks. And those responsible will not a

The challenge is that chief executives, boards and audit committees set a tolerance to risk, like they do with all other risks. And those responsible will not accept a high level of residual risk, so we put controls in. The challenge is knowing what the best controls are. Chances are if its already happened and you haven't detected that it has, then you've really not taken cybersecurity seriously.