I was told by both the insurance broker and our IT support techs that it's not a matter of if, but a matter of when.

I was also told that more and more cyber policies are not even accepting customers if in addition to all the standard protection protocols, they are also not using multi-factor authentication in all business workstations.