I see this kind of measurement fallacy all the time where corporate risk management interacts with security — if you can't handle qualitative evaluations, you're going to have a bad time for a long time.
https://post.lurk.org/@loriemerson/110159784306810562