As IT transformation initiatives expand the digital footprint, they outpace the security protections companies have in place. This dilemma presents a sobering reality: security and privacy internal control structures that are effective in reducing risk to an acceptable level today will inevitably become inadequate in the future—and even sooner than we may realise. Boards of directors need to ensure that the organisations they serve are improving their cybersecurity capabilities continuously in the face of ever-changing cyber threats.