That's what he was saying... >Infosec isn't a real profession. Among the things missing is proper "risk analysis". Instead of quantifying risk, we treat it as

That's what he was saying... >Infosec isn't a real profession. Among the things missing is proper "risk analysis". Instead of quantifying risk, we treat it as an absolute. Risk is binary, either there is risk or there isn't. We respond to risk emotionally rather than rationally, claiming all risk needs to be removed. This is why nobody listens to us. Business leaders quantify and prioritize risk, but we don't, so our useless advice is ignored.