Introduction In my experience, people tend to make decisions on where to invest in cybersecurity controls based on one of the following approaches. Sure, there are lots of exceptions, the audit finding, the article your CEO read, or ‘the horse has left the barn, time to close that gate’ approach. When, however, we think about Cyber…