Attacks against critical infrastructure are attacks against the lives of citizens, the success of entrepreneurs and the fundamental values of the European way of life. We are at a crossroads and we need to decide where to go next. There is information about new incidents and then there is new legislation and initiatives, such as the revision of the NIS Directive, or the common governance framework. Cyber security is like a travelling train. Not jumping on today may mean higher costs in the future or even a lost opportunity to catch up.