When we deploy protection, normally it might be of civilian grade even it appears harder to break in. If attack is originated from state-level as a targeted attack, such civilian grade countermeasure won’t be effective.
That is why a 360 degree assessment is needed to decide threat actors, likelihood, consequence and then the corresponding countermeasures.