Cyber breaches are often portrayed as the result of sophisticated attackers, yet many incidents are enabled long before compromise occurs. Organisational behaviours such as delayed patches, recurring exceptions, ignored audit findings, security fatigue, and risk acceptance quietly create the conditions that attackers exploit. This talk examines the cultural and operational patterns that tend to precede breaches, drawing on case studies across various industries to highlight how risk normalisation and organisational drift increase exposure.