Not to mention that there is very little motivation given for the quantification of the individual threats. Not having 2fa is apparently 1 point, backing up onl

Not to mention that there is very little motivation given for the quantification of the individual threats. Not having 2fa is apparently 1 point, backing up only ever few weeks is 2, .. it almost seems as if these were chosen retroactively to make the curve look the way it does. From the paper: > Given the results above, we now present and discuss a proof-of-concept approach to risk assessment to estimate futureransomware infection that is based only on self-reported se-curity habits and past exposure to online scams. The methoddemonstrates that assessments can, in theory, be made with relatively little information, enabling consumers to estimatetheir own risk. We stress from the outset, however, that wemerely intend to illustrate the general approach; in particular, the strategy we present would need to undergo more rigor-ous evaluation before it could be responsibly used for riskassessment in the broader population. Seems tenuous, that disclaimer notwithstanding.