I went for a seminar today for Mimecast email services, It was very informative regarding email security and keeping our environment hack free however something that stood out for me was the mention that there is no "if" and attack happens, we as IT staff should prepare for the "when" it happens.