When optimizing cybersecurity capability, the scope must be holistic and discretely applied. Cybersecurity needs to operate effectively at a micro and at a macro level. At a macro level, the entirety of an enterprise — processes, risk profiles and tolerances, personnel and enterprise culture, and so on—must be taken into consideration, as must external environmental factors, such as the market environment that the enterprise operates within and public perceptions of its actions. A focus on an enterprise’s internal environment should not come at the expense of a focus on its external one; both merit equivalent focus of expertise, resources and concern. At a micro level, individual measures, practices and controls must operate with precision and accuracy; they must be resilient to attack, hardened to circumvention and feed into the broader, holistic risk management strategy.