The USD 2.5 million cyber breach at Sri Lanka’s Ministry of Finance exemplifies weak behaviours and cyber defenses, but it also manifests deeper systemic challenges. It shows a lack of infrastructure, governance, and protective measures where operational and institutional processes have not been developed and evolved to adapt to today’s sophisticated and advanced cyber threats.This is particularly relevant to Sri Lanka’s many initiatives which fall within e-governance, digital payments, and interconnected systems in services to citizens.