Understanding cyber risk is the first step. Mitigating it requires the right mix of employee training, readiness testing, and ongoing awareness.