Thoughts? When regulators want you to demonstrate cyber risk management, that requires an understanding of threats and vulnerabilities.