The old adage of when not if always applies when we consider cyber security.