When do you want to stop a cyber-attack?

The answer to this question is always ‘Immediately!’ and certainly never ‘After the horse has bolted’.