> The folks making these decisions are not sophisticated and competent in risk management Aren't they pretty good at financial risk? isnt that like their only

> The folks making these decisions are not sophisticated and competent in risk management Aren't they pretty good at financial risk? isnt that like their only job a lot of the time? Idk it seems to me it must be possible to make a good argument for this stuff - How do cybersecurity consulting firms pitch to clients? Could McKinsey etc get in on it? It's just hard internally because a lot of the time it requires the culture to have been there from the beginning. Changing the culture if it's not present already is like trying turning a supertanker with a desk fan. People resent loss of freedoms, and operational restrictions prevent getting everyone to understand the whys