How do you communicate the importance of a strong risk mitigation strategy? It's easy to talk about fixing things after they've broken, but how do you showcase the value of preventing things from breaking in the first place? Do you quantify the cost avoidance, for example?

I would start by explaining the obvious, that we are used to a classical approach to risk mitigation where the risks are driven by people rather than what is happening now where risks are going to be increasingly driven by agentic AI.  

If the modern LLMs are good at anything it is in finding things that are connected that other examiners have missed.  Risk mitigation is becoming an area that must be the most creative aspect of cybersecurity because of the way hackers are leveraging models to probe defenses, iteratively and in an automated fashion with absolutely zero fear of downside - which will lead them to look for "any" angle rather than angles deemed the most lucrative.

Anyone with a simple way to quantify risk with a monetary value, please share.