Organisations need to change their way of thinking about cyber risks. Instead of just focusing on threats, they should look at the potential harm that cyber attacks can cause. By understanding these harms, they can better protect their assets and the people who rely on them. This shift can help companies make smarter decisions about cybersecurity.