What defines a “high-risk” position from the perspective of a company’s cyber security depends greatly on the nature of the company’s cyber assets.