[ben509]

> I would get asked "will you stake your career on it never happening?" Of course not.

"Let's make a bet over whether a customer reports an authenticator app gets hacked before a customer's account without an authenticator is broken into. If the authenticator app is hacked first, I'll resign. If an account with no 2FA is compromised, you resign."

[sjy]

This is probably just meant to be a joke, but I have been in that situation before and I don't think offering to gamble away your job would be an effective way to convince others to accept your advice on risk management. I still don't know how to effectively convince others to take on new risks in order to avoid bigger risks presented by the status quo. Given the additional risk that my risk assessment is deficient, doing nothing is usually the easier decision.

[cs02rm0]

I still don't know how to effectively convince others to take on new risks in order to avoid bigger risks presented by the status quo.

I think you just need to be talking to someone who can understand the risks you convey, has the responsibility for both risks and the authority to effect the necessary change.

IME that's straightforward in most small companies and in large government departments it's rarely one person but multiple committees of people who you'd never be able to explain the risks to and who won't make a decision.

Feel my pain?!

[ben509]

It's meant to be talking trash online, so you're right to take it with a grain of salt.

But I'll stand behind the view that when ideas are being shot down with challenges like "would you stake your career on this" then a bull-headed approach is worth a try.

> I don't think offering to gamble away your job would be an effective way to convince others to accept your advice on risk management.

It won't persuade technically minded people, but it tells decision makers that you're confident, and offers them a measure of accountability.