Cyber incidents targeting organisations – particularly those against critical national infrastructure (CNI) – are becoming more frequent, sophisticated and potentially destructive.