How strong are your passwords? Is your software patched and up-to-date? Do your employees know how to tell the difference between a phishing email and a genuine message?

If you can't answer these questions, your organization is probably already vulnerable to an attack.