The first hurdle to overcome is recognising that cybersecurity is not the same as cybersecurity risk management.