Thinking cyber attacks will not happen is an outdated mentality in a digital world, however low the risk may be at the current time. Understanding personal responsibility and information governance and security in a digital world is very different from the paper-based world that health and care organisations, among others are moving away from. Being “one step ahead” of the cyber attacks means having secure systems and being trained to handle cyber attacks.