We are stilling seeing Cybersecurity being treated as a cost, a very expensive necessity. And even the necessity is more often challenged than accepted. Conversations about the costs of a significant cyber incident are still too often closed by labeling these as "project fear" when organization have not yet been confronted with these incidents, or the incidents that occurred did not cause the full potential damages. As a result of this line of thinking, the necessary budgets and resources are not made available, and every day without significant cyber incident is seen as another confirmation that it isn't all that bad.