Expecting the unexpected: Cybersecurity for critical infrastructure