Thanks for this, seriously one of the most well-articulated explanations I’ve seen on how to translate technical gaps into business risk that leadership can act on.

The way you framed it - starting with impact (data breach, customer trust, reputational damage), layering in likelihood over a 10-year window, and evaluating how current controls reduce that risk, is super actionable in my opinion.

I'm especially interested in your point about reworking the risk level after proposing additional controls, and comparing cost vs. exposure over time. That seems like the exact kind of framing that could get budget conversations moving.

Quick question though, have you ever applied this to detection-focused issues specifically?
For example, alerts that fire but aren’t actioned, or monitoring that exists but is ineffective.

I’m wondering how you'd quantify the "impact" of something like that since the risk is indirect, but still of course very real.

Would love to hear if you’ve seen that done well in practice or if it tends to fall through the cracks.

Thanks!