The factors leading to a cyber attack go beyond the technical. Whilst it is key to understand how a vulnerability was technically exploited, organisations should also understand why a vulnerability was not caught sooner, how the response was managed (including communications) and how it could be improved to reduce the impact of future incidents.