Compliance is not enough to thwart cyber attacks