Automated an improved Threat Risk Assessment process in a collaboration tool SAaS, learned people outside security don’t care about modelling risk at the design

Automated an improved Threat Risk Assessment process in a collaboration tool SAaS, learned people outside security don’t care about modelling risk at the design stage for two reasons. The first is the 3rd party advice is what makes it valuable, and anything beyond basic compliance is economically wasted. Second was security governance people and consultants jobs depend on the flexibility to make their own representations in a narrative. “Ur doing it wrong, fixed it for you,” is simply not the sound basis of a product. Other related lessons include: Risk is future value and present leverage. Your vulnerable dependency is someone’s optimized business model. Principal/agent problems aren’t actually problems to be solved, they are management consulting opportunities. A cluttered spreadsheet is someone’s job, that is someone else’s headcount, in still someone else’s budget, as part of yet someone else’s opex projection, provided as part of a financing, that yields someone’s commission, carry, and management fee. Looking forward to next play, which one hopes will be smarter. :)