Cybercriminals: the 'auditors' you never hired

An opinion piece warning that "normalcy bias" leads organisations to underestimate cyber risk despite rising nationally significant incidents and extensive malicious activity; it cites NCSC and ESET data and urges proactive measures—regular penetration testing and red/blue/purple team exercises, continuous monitoring, MDR/MXDR services, cyber awareness training, and supplier scrutiny—to avoid outsourcing assurance to attackers.