Boards don’t want to get caught in a crisis, let alone one in which they were warned but caught unprepared. Boards need to challenge the paradigms by which they think of security, increase their knowledge of security as a business strategy, and respond with concerted management, strengthened posture and preparation.