But there is another number that perhaps best describes the lack of resources in the system before everything went wrong: three.

That’s how many IT security staff there were for the entire provincial health system, according to a post-attack report by the Canadian Centre for Cyber Security.

Cybersecurity (and IT in general) represents a trap for shortsighted managers. As long as nothing goes wrong, which can go on for quite a long time with some luck, cuts to this department look like savings on the balance sheet with little downside. It’s only when something goes catastrophically wrong where the true costs of those cuts manifest.