"If an organization does business anywhere on the Internet, it is likely not a question if, but when it will be targeted by cyber criminals."

Using "likely" relieves you of the burden of proof, but, I know several companies that live on the internet, have for many years, and have not been targeted.