Companies are in a virtual arms race with attackers, so they need to get cyber risk basics right even to have a chance of staying one step ahead.