Every industry has to do a bit of selling – to spin the product in an appealing way. But advertising is almost always subject to an enforceable code of practice, setting out how much creativity is too much. I wonder if there ought to be something similar applied to cyber, to close the gap between what security is presented as, and what you actually get.