4 ms·

I would add that "How the Measure Anything in Cybersecurity Risk" should be a core part of Infosec literature.