“Until recently, trying to assess the cyber risk for a giant multi-million-dollar industrial facility has been an antiquated process.”