Every chief information security officer knows it isn’t a matter of “if” but “when” the systems that run their business will be disrupted in some way.