Cyberattacks on critical infrastructure have been dominating the headlines for years. This is because cybercriminals recognize that many of the companies responsible for providing and maintaining infrastructure are vulnerable – they often use outdated and insecure legacy systems, their employees click on phishing links and attachments, and a single entry point can give hackers access to sprawling infrastructure networks. Cybercriminals also recognize that, due to the vital importance of infrastructure, they can demand large sums of money to get systems back online. These are all reasons why companies in the infrastructure sector need to focus on teaching employees how to identify and prevent cyberattacks.