“I am a physical retailer by trade - if your shop is burgled you don't immediately think, 'Is it North Korea? Is it the Mafia?' But with cyber you don't know initially whether you're dealing with a state actor, as they call them, a small-time criminal, an insider.”