Try preventing cyber-exposure and you risk focusing on the wrong areas. Most incidents arise by accident rather than criminality. We must unpick intractable socio-technical systems where incidents spring from nowhere. Understand why things normally succeed, not why they sometimes go wrong. That way we can contain cyber-exposure, identify critical functions and understand what risk really means.