I don't disagree. But my follow-up response is "don't leave it there; factor that into the probability tree". What should professionals in cybersecurity do? (N

I don't disagree. But my follow-up response is "don't leave it there; factor that into the probability tree". What should professionals in cybersecurity do? (Not my field, so I could be off-target here) My recommendation: communicate a risk model [1], encourage people to update it for their situation, and demand that people act on it [2]. Not too different from what the field of cybersecurity recommends now. (Or am I wrong?) [1] based on a set of attack trees (right?) [2] based on the logic that if you get pwned, you become a zombie to attack me