The worst time to find out if your Cyber Security is
NOT WORKING is
after a Cyber ATTACK.
Because then you face the scrutiny of everyone around you, your clients will demand answers immediately, they will leave in droves, and probably sue you quickly after that.