[mrex]

Develop sufficient in-house subject matter expertise so that you're not depending on sales consultants to do your cyber program for you.

Develop an empirical understanding of risk management. While we can't predict the future, through well established techniques and adequate resourcing, professionals can achieve consistent results that are far better than random guessing. Risk management principles drive not just corporate stragegy writ large, but entire industries like banking and insurance.