In cybersecurity, it’s called the compelling event: when a serious security incident occurs that causes financial loss or serious brand damage. Usually the organisation has been aware of the risk but there’s insufficient budget to cover the expenditure to mitigate the risk. On a rare occasion, the incident comes as a complete surprise.