[baxtr]

I think for thinking this through it is crucial to think in “consequences”. We get these by asking “what would be the business impact of this”?

I see the following things potentially happen:

#1 Business interruption: due to lack of knowledge an important breaks down and the business can’t do any business. The frequency and impact of such events will eventually trigger a response by management. Could this be have been solved cheaper and easier before? Maybe

#2 Data leaks: since system aren’t secured well enough, data will get lost. The impact of this is hard to measure.

I think both risks are manageable.

Any other consequences I am missing?