1. Too much acceptable risk
Numerous reports have indicated Sony knew of the insecurity in its systems and processes but didn’t take stronger measures. For example, its security information team only had 11 employees—a small amount for company whose intellectual proprietary assets are so vital. If the high level of risk was known, apparently Sony thought (incorrectly) it was acceptable within its processes. The lessons for risk managers: Be careful on how much risk you are willing to live with, and be sure vendors are devoting enough resources to mitigate threats you consider significant.