At the turn of the millennium, a disgruntled employee hacked the sewage control system of Maroochy Shire, on Queensland’s Sunshine Coast. As a result, one million litres of untreated sewage was released into local parks and rivers. This caused marine life to perish and creek water to turn black, according to the Australian Environmental Protection Agency, and the stench became “unbearable” for residents. Since then, cyber attacks against critical infrastructure and operational technology globally have grown in number, sophistication and severity, and have been carried out by nation states, hacktivists and criminal groups motivated by ideology or money. But even as cybersecurity technology develops rapidly, business practices and policies are not evolving fast enough.