“I think most organizations understand that they will be attacked at some point, so in theory they understand the need for a focus on cyber resilience; but they are struggling to implement and measure it as a program,” says Tia