Cybersecurity professionals fight a never-ending battle as new viruses, malware, ransomware and phishing exploits spread exponentially. Even companies in full compliance of industry regulations get exploited. Technology can only help, but companies reliant exclusively on technology develop a false sense of cybersecurity. Now is the time to shift from “check box compliance” to risk-based security defenses that rely on incident response (IR).