The shape of cybersecurity in an organisation is critical to its success and legal health. Incident response must circle back to preventative security