For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge. Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected. The obvious conclusion is that we are asking the wrong questions.