The authors are grateful to the UK’s National Cyber Security Centre and the Research Institute forSociotechnical Cyber Security for providing funding for this paper and their support throughoutthe research process.

A great deal of thanks must go to the RUSI team that helped to guide and shape this paper. SnehaDawda, Chris Goodenough, Hugh Oberlander, Dina Mansour-Ille, Demi Starks, Zenab Hotelwala,Tom Sayner and Sarah Hudson all provided valuable support and editing. The authors would alsolike to thank Rebecca Lucas, formerly of RUSI, for her outstanding work on the literature reviewand other data collection that helped form the basis of much of the paper.Thanks also go to Josephine Wolff, Graham Walsh and Ioannis Agrafiotis for peer reviewing thepaper with such diligence, as well as the various individuals from government, the insuranceindustry and cyber security providers who provided insightful feedback on the recommendations.A final thank you goes to the participants in this research, to all those who very kindly gaveup their time to participate in interviews and workshops when 2020 and 2021 were andcontinue to be challenging for us all. Every single interview contributed greatly to the authors’thinking and findings.