What should companies be doing to protect themselves from cyberattacks? A Q&A with a cybersecurity expert