When a cyber incident occurs, the challenge is rarely a lack of technology. More often, it is a lack of visibility, clarity or understanding of where responsibility sits, how risk is being managed and whether the organisation's existing security capability is genuinely aligned to its threat landscape.