Businesses need to take responsibility for their own cyber security strategies.