Why cyber hygiene isn't enough

In numerous discussions and forums recently, the conversation about the need for a risk management approach to cybersecurity has quickly devolved into a discussion about cyber hygiene and, ultimately, a discussion about compliance (with perhaps some simple metrics thrown in).
+ Also on Network World: Match security plans to your company's 'risk appetite' +
This pattern of following a difficult, but business-oriented discussion of risk to a trivial oversimplification is common within govern