While the pandemic and enhanced digitalization have introduced more types of cyber threats, the authors assert that most recent high-profile attacks are not very sophisticated. Rather, they happen when basic cybersecurity practices are ignored or overlooked. It is likely that organizations are overestimating certain types of cyber risk, leading to overspending to secure gaps. There is also a danger that overly restrictive practices will reduce employee productivity and stifle innovation. Therefore, a realistic risk assessment after implementation of basic security practices and commensurate controls is important.