My old boss was very disturbed when we explained to him that our small business with one IT guy can't really defend against state-level actors who are intent on getting into our systems.

I'm still not sure why he was worried about that.