To build a solid cybersecurity program, talk to leadership about risks