There is a common misconception that cybersecurity fundamentally relates to the implementation and management of technical and non-technical control measures - installing firewalls, doing pen tests and implementing security awareness programmes. Whilst all of these are valid activities, much like any business activity cybersecurity is really about understanding the risks your business faces and putting mitigations in place to reduce that level of risk to an acceptable level.
