Cyber risk is a product of threats, vulnerabilities and consequences. Driving any one of these to zero, will achieve zero risk. Most of us do not have a James Bond 007 license and thus cannot eliminate threats. For some time the general belief has been that all vulnerabilities can be eliminated, thus driving cyber risk to zero. Are there any CISOs who are telling their CEOs that all vulnerabilities are eliminated? Detection is a much more diff...