According to Chris Morales, head of security analytics at Vectra, there’s nothing in particular these companies are doing wrong – but once a hacker has decided to target a business, all they have to do is bide their time.