It’s a widely believed view by leaders that their organization is either one that has already experienced a cyber-attack or one that will be a target