A risk based approach, owned by the business to target key critical cyber risks is sorely needed.