This article raises some interesting points about who should be responsible for the UK's cyber resilience and how should it be tested.