any company big enough to be targeted can make up some excuse to be "critical" but yet still can't be bothered to step up their cybersecurity?