What is Board-Level Risk & Compliance Reporting?

Board-Level Risk & Compliance Reporting in cybersecurity is the strategic translation of complex technical vulnerabilities, external exposures, identity threats, and supply chain liabilities into objective, business-aligned governance metrics, defensible compliance evidence, and quantifiable digital trust indicators.

Corporate boards of directors, audit committees, and executive leaders do not evaluate cyber risk through raw Common Vulnerabilities and Exposures (CVE) counts, firewall log volumes, or technical vulnerability scatter plots. Instead, governing bodies evaluate risk through the lens of fiduciary duty, financial exposure, operational resilience, and statutory regulatory compliance. This mandate is accelerated by global regulatory pressures, including:

• SEC Cybersecurity Disclosure Rules: Strict mandates requiring public companies to describe board oversight of material cyber risks in annual Form 10-K Item 106 filings and disclose material cybersecurity incidents within four business days on Form 8-K Item 1.05.

• EU AI Act & Global AI Governance Mandates: Severe statutory penalties (reaching up to €35 million or 7% of global annual turnover) for non-compliant, unmonitored Artificial Intelligence systems and shadow AI pipelines.

• Statutory Privacy & Data Fiduciary Frameworks: Requirements under GDPR, DPDPA, HIPAA, and NIS2 that demand verifiable technical oversight over sensitive data stores, third-party access, and external breach points.

Traditional security reporting suffers from Compliance Blindness—a dangerous operational gap where an organization discovers an external vulnerability or asset drift but lacks the context to correlate it with the specific regulatory control, compliance framework, or board-level fiduciary risk it impacts.

Board-Level Risk & Compliance Reporting bridges the communication divide between the Security Operations Center (SOC) and the boardroom. It converts unauthenticated, empirical outside-in technical findings into defensible Cyber Risk Quantification (CRQ) models, framework-aligned oversight reports, and clear remediation roadmaps.

How ThreatNG Solves Board-Level Risk & Compliance Reporting

ThreatNG serves as the definitive translation layer between tactical security operations and executive governance. Operating as an unauthenticated external scout that delivers The Connectorless Ground Truth, ThreatNG unifies External Attack Surface Management (EASM), Digital Risk Protection (DRP), and continuous Security Ratings into a single platform.

Rather than relying on self-reported vendor questionnaires or theoretical mathematical estimations, ThreatNG uses empirical, outside-in discovery to deliver Legal-Grade Attribution and transparent, penalty-based exposure ratings through its DarcRadar scoring formula. By functioning like a continuous "telematics chip" that monitors an organization's dynamic digital behavior in real time, ThreatNG replaces speculative actuarial guesses with verifiable facts, arming Chief Information Security Officers (CISOs) and Chief Compliance Officers (CCOs) with the documentation required to substantiate audit compliance and justify strategic security investments to the board.

External Discovery for Governance & Compliance

Board-level governance requires an unassailable inventory of all digital properties owned, operated, or leveraged by the enterprise. ThreatNG establishes an authoritative, connectorless inventory baseline across primary brands, acquired subsidiaries, and third-party partners without requiring internal agents, network credentials, or API keys.

• Connectorless Asset & Perimeter Inventory: Evaluates authoritative Domain Name System (DNS) zone files, public domain registries, SSL/TLS certificate transparency logs, Regional Internet Registry (RIR) databases, and global Border Gateway Protocol (BGP) routing tables. This maps every public-facing IP block, subdomain, cloud deployment, and application to establish an empirical inventory of record for board audit committees.

• Patented Recursive Discovery for Shadow IT & Shadow AI: Iteratively expands outward from initial corporate seeds (such as apex domains, ASNs, or brand names) to unearth developer staging sandboxes, regional marketing micro-sites, and unmanaged cloud environments deployed across AWS, Azure, and GCP that lack corporate logging agents and endpoint sensors. Crucially, it uncovers exposed machine learning infrastructure (such as Langflow, Ollama, and vector databases), eliminating the Shadow AI blind spots that trigger EU AI Act non-compliance penalties.

• Non-Human Identity (NHI) & Secret Discovery: Continuously monitors public version control systems (GitHub, GitLab, Bitbucket), paste sites, and public cloud environments for hardcoded API keys, database connection strings, and cloud service credentials accidentally leaked by internal developers or third-party contractors.

• Third-Party Dependency & SaaS Mapping (SaaSqwatch): Evaluates public DNS CNAME routing chains, HTTP headers, and certificates to catalog third-party SaaS services and multi-tier supply chain dependencies, giving boards verified visibility into vendor ecosystems operating outside central IT oversight.

• Algorithmic Permutation Discovery for Brand Infrastructure: Automatically computes and evaluates mathematical permutations of corporate domain names (typosquats, combosquats, and homoglyphs) to identify taken domains configured with active Mail Exchange (MX) records, providing boards with clear metrics on adversary staging targeting corporate brand equity.

External Assessment

ThreatNG elevates compliance validation from subjective policy surveys to deterministic, evidence-backed assessment using its Known Vulnerability Exposure Verification (KVEV) engine, proprietary Security Ratings, and 4-Dimensional (4D) Data Model. The 4D model cross-references National Vulnerability Database (NVD) baselines, 30-day Exploit Prediction Scoring System (EPSS) probabilities, Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) listings, and verified Proof-of-Concept (PoC) exploit scripts in DarCache eXploit.

• Detailed Assessment Example 1: Known Vulnerability Exposure Verification (KVEV) on Core Public Portals: When internal compliance scanners flag hundreds of unpatched servers, boards often receive confusing, high-volume vulnerability counts that obscure true business risk. ThreatNG’s KVEV engine performs live, unauthenticated checks from the public internet against internet-facing web portals and middleware. It confirms external reachability, checks against the CISA KEV catalog, calculates 30-day EPSS weaponization probabilities, and cross-references active exploit scripts in DarCache eXploit. If an external payment portal exhibits an EPSS score of 0.92, is listed on the CISA KEV catalog, and has active exploit scripts in DarCache eXploit, ThreatNG classifies it as an active deterministic exposure. This provides board committees with empirical proof of exploitability, cutting through the noise of passive internal logs and proving which critical flaws represent immediate material liability.

• Detailed Assessment Example 2: Subdomain Takeover Susceptibility and Dangling DNS on Acquired Brands: During corporate mergers and brand acquisitions, enterprises frequently inherit neglected subdomains pointing to decommissioned third-party cloud hosts. ThreatNG cross-references discovered subdomains across multi-cloud environments against a catalog of over 60 cloud services (such as AWS S3, Azure, Heroku, and GitHub) and validates whether the underlying resource is unclaimed. It assigns an A through F Subdomain Takeover Susceptibility rating. When an authoritative CNAME points to an unclaimed resource returning an HTTP 404 state, ThreatNG delivers empirical proof of an active takeover condition. This allows executives to demonstrate to regulatory auditors that dangling DNS entries are identified and decommissioned before adversaries hijack corporate namespaces to conduct phishing or disinformation campaigns.

• Detailed Assessment Example 3: Non-Human Identity (NHI) and Leaked Machine Secret Assessment: ThreatNG evaluates external exposure variables—including open non-standard ports, accessible environment variables, public cloud configurations, and unvetted webhook endpoints—to locate exposed programmatic machine identities. It identifies exposed API keys, service principal tokens, and cloud access credentials, computing an NHI Exposure Rating (A through F). If a public code repository leaks an active cloud administrative key with write access to production database systems, ThreatNG calculates the blast radius across connected internal systems, proving to audit committees that unauthorized programmatic access pathways are discovered and severed before an external breach occurs.

• Detailed Assessment Example 4: Data Leak Susceptibility on Exposed Cloud Storage Buckets: Under privacy statutes such as GDPR and HIPAA, boards bear direct responsibility for unauthorized disclosures of sensitive consumer records. ThreatNG evaluates public cloud storage instances across AWS S3, Azure Blob, and Google Cloud Storage for unauthenticated read and write permissions. It assigns an A through F Data Leak Susceptibility rating to identify open cloud buckets containing customer databases, backup archives, or batch logs, providing immediate proof of exposure to support defensible regulatory disclosures before data exfiltration occurs.

• Detailed Assessment Example 5: Insecure Header and Web Application Hijack Susceptibility: ThreatNG inspects public application endpoints, portals, and microservices across all discovered subdomains for missing or weak HTTP security headers—specifically evaluating subdomains missing Content-Security-Policy (CSP), HTTP Strict Transport Security (HSTS), X-Content-Type-Options, and X-Frame-Options. It assigns an A through F Web Application Hijack Susceptibility rating, establishing empirical evidence for compliance auditors that corporate web portals enforce modern browser-side protections against clickjacking and cross-site scripting (XSS).

Strategic Reporting

ThreatNG standardizes the communication of verified exposures by converting raw outside-in telemetry, infrastructure graphs, and technical exposure metrics into structured, auditable records designed for corporate boards, compliance directors, and regulatory agencies.

• Executive Security Ratings & DarcRadar Dashboards: Converts complex technical metrics, exposed configurations, and digital risk indicators into standardized A through F security ratings across categories including Cyber Risk Exposure, Data Leak Susceptibility, Supply Chain & Third-Party Exposure, and Non-Human Identity (NHI) Exposure. Using the transparent, penalty-based DarcRadar formula, ThreatNG provides objective ratings backed by deterministic evidence rather than opaque, theoretical math, giving boards a reliable benchmark to measure security ROI and performance over time.

• Correlation Evidence Questionnaires (CEQs): Dynamically generates CEQs based on confirmed external discovery and assessment results. The CEQ acts as an EASM-to-Audit Translation Layer, transforming unauthenticated outside-in discoveries—such as an unpatched edge device, a dangling DNS record, or missing DMARC enforcement—into targeted, auditable inquiries mapped directly to regulatory frameworks across four functional pillars: Technical, Strategic, Operational, and Financial.

• Executive Action Plans Aligned to Industry Frameworks: Automatically correlates raw external discoveries into strategic executive action plans mapped to regulatory and security standards:

  • MITRE ATT&CK & MITRE ATLAS: Maps exposed web assets, APIs, and AI systems directly to adversarial tactics and techniques (e.g., Reconnaissance, Resource Development, and Initial Access), providing boards with business context on adversary campaigns.

  • NIST CSF 2.0 & Open FAIR: Translates external exposure pathways into defensible Cyber Risk Quantification (CRQ) scenarios and Annualized Loss Expectancy (ALE) projections, converting technical flaws into financial risk metrics that executive committees can evaluate directly.

  • EU AI Act & Global AI Governance: Maps unmonitored AI endpoints and vector databases to specific compliance articles, ensuring audit readiness and eliminating non-compliance penalties.

• U.S. SEC Cybersecurity Disclosures Report: Directly aligns an organization's public regulatory filings (Form 10-K Item 106 risk management governance and Form 8-K Item 1.05 incident materiality determinations) with the verifiable technical reality of its external attack surface. This eliminates disclosure disconnects and protects corporate officers from regulatory enforcement actions and shareholder litigation.

• Forensic Evidence Packages for Audit Defense: When ThreatNG verifies an active vulnerability, exposed storage bucket, or compliance failure, it generates a comprehensive forensic evidence package containing technical markers, DNS resolution histories, HTTP response headers, affected URLs, and proof of ownership to substantiate internal audit logs, cyber insurance renewals, and external regulatory filings.

Continuous Monitoring

Because software teams continuously deploy cloud infrastructure, modify DNS records, and integrate third-party tools, point-in-time annual audits create dangerous compliance gaps. ThreatNG delivers 24/7 continuous external surveillance across the extended digital footprint.

The platform tracks asset state changes, newly registered subdomains, modified DNS records, fresh certificate issuances, and emerging zero-day vulnerabilities in real time. If an unauthorized developer team exposes a new database to public traffic or commits an administrative key to a public repository, ThreatNG detects the configuration drift immediately. Furthermore, ThreatNG incorporates its Overwatch capability—a cross-entity vulnerability intelligence system that instantly evaluates exposure across an entire portfolio of subsidiaries, business units, and supply chain partners whenever an emerging zero-day vulnerability or regulatory enforcement wave is announced, arming leadership with verified impact reports within seconds.

Investigation Modules

ThreatNG features specialized investigation modules that let security analysts and compliance officers trace technical exposures, investigate credential leaks, and evaluate the full context of governance failures.

• Detailed Module Example 1: The DarChain Exploit Path Mapping Engine: DarChain (Digital Attack Risk Contextual Hyper-Analysis Insights Narrative) chains isolated technical, credential, and environmental discoveries into predictive attack graphs. For example, DarChain maps how an attacker discovers an abandoned staging subdomain hosting an unpatched API gateway, correlates that finding with a leaked cloud database credential identified in a public code repository, and demonstrates how that path leads directly to proprietary customer databases governed by GDPR. Instead of presenting the board with disconnected vulnerability lists, DarChain pinpoints the critical Attack Path Choke Point where a single targeted operational fix severs the entire intrusion path.

• Detailed Module Example 2: Sensitive Code Exposure Module: ThreatNG continuously monitors public code repositories (GitHub, GitLab, Bitbucket) and paste sites for leaked corporate secrets. This module uncovers hardcoded API keys, private SSH keys, Jenkins credentials, AWS access tokens, and database connection strings committed by internal developers or third-party contractors. The module provides exact repository URLs, commit timestamps, and file paths, delivering undeniable proof of whether development practices comply with internal data governance policies.

• Detailed Module Example 3: Subdomain Infrastructure Exposure Module (Shadow AI Discovery): Within Subdomain Intelligence, this module inspects discovered subdomains for exposed administrative interfaces, development pipelines, and automated tools. It detects exposed orchestration frameworks (including Langflow, self-hosted n8n, AnythingLLM, LM Studio, LiteLLM, Ollama, OpenAI-compatible APIs, and Clawdbot/Moltbot), vector databases (QDrant, Milvus, local Pinecone, and DuckDB), and Model Context Protocols (MCP). This delivers verifiable evidence of unmonitored shadow AI deployments, ensuring compliance teams can enforce corporate AI governance policies.

• Detailed Module Example 4: Dark Web Presence and Infostealer Intelligence: Operating through its dark web intelligence modules, ThreatNG continuously monitors underground marketplaces, paste sites, and infostealer malware logs for compromised corporate credentials, session cookies, and corporate mentions. This module parses log clouds to identify when workforce credentials or active Single Sign-On (SSO) session tokens appear in botnet archives, delivering empirical evidence of identity theft to support defensible regulatory incident assessments.

• Detailed Module Example 5: Cybersecurity AI Prompts (DarcPrompt): DarcPrompt packages verified attack-surface context and attack-path findings into structured prompt blueprints. Featuring specialized personas—such as External Attack Paths, Shadow IT and AI, and External GRC Assessment—DarcPrompt applies strict architectural constraints that bind the prompt to ThreatNG's proprietary ground truth. Through an Air-Gapped Handoff, security analysts safely copy these blueprints into their internal private enterprise AI systems to draft board memos, audit responses, and executive risk summaries without exposing sensitive asset data to public AI services.

Intelligence Repositories

ThreatNG centralizes and structures threat intelligence through the DarCache intelligence engine, providing an interconnected dynamic ecosystem that grounds board reporting in empirical adversary reality:

• DarCache Vulnerability & eXploit: Integrates NVD baselines, CISA KEV listings, 30-day EPSS probabilities, and verified PoC exploit pointers to evaluate whether perimeter software flaws are actively weaponized in the wild, providing the objective data needed to justify emergency patching budgets to the board.

• DarCache Infostealer: Parses dark web logs, Telegram channels, and illicit cloud archives for compromised corporate credentials, session cookies, and Primary Refresh Tokens (PRTs), helping teams quantify workforce identity risk for executive leadership.

• DarCache 8-K & ESG: Tracks SEC Form 8-K filings, global ESG violations, and corporate regulatory disclosures, providing non-technical governance indicators that connect digital attack surface risks directly to financial materiality, board oversight, and legal exposure.

• DarCache Ransomware: Tracks active ransomware cartels and their specific tactics, techniques, and procedures (TTPs), monitoring whether threat actors are targeting assets within specific industry sectors or subsidiary brands to inform board risk registers.

• DarCache Bug Bounty: Aggregates and analyzes historical bug bounty program disclosures, researcher activity trends, and crowdsourced exploit patterns to evaluate which public perimeter assets are under active scrutiny by external researchers.

• DarCache Dark Web & Rupture: Scans underground forums, paste sites, and dark web sources for threats to brand assets and personnel, while tracking compromised corporate credentials, session cookies, and data leaks across all domain permutations.

• DarCache Mobile: Detects hardcoded access credentials, security keys, and platform-specific identifiers within public mobile applications, discovering mobile software assets and connected cloud backends that require compliance validation.

• DarCache BIN: Monitors Bank Identification Numbers (BINs) to identify and prevent potential payment card fraud across digital transactional and e-commerce assets, supporting PCI-DSS compliance oversight.

Cooperation with Complementary Solutions

ThreatNG functions as an external intelligence scout that cooperates seamlessly with complementary solutions across enterprise governance, risk, and security operations to deliver defensible board reporting and automated compliance validation.

• Cooperation with Governance, Risk, and Compliance (GRC) & TPRM Platforms: ThreatNG feeds empirical, outside-in technical evidence, continuous Security Ratings, and Correlation Evidence Questionnaires (CEQs) into complementary solutions (enterprise GRC and TPRM platforms). While traditional GRC tools manage qualitative policy assessments and vendor surveys, ThreatNG adds a continuous technical validation layer—automatically flagging when a critical subsidiary's rating drops or a third-party vendor violates patching compliance, and populating audit registers with verifiable proof.

• Cooperation with Cyber Risk Quantification (CRQ) Platforms: ThreatNG passes verified external reachability telemetry, KVEV vulnerability verifications, and DarChain attack paths into complementary solutions (CRQ engines operating on Open FAIR models). This replaces hypothetical threat probabilities with empirical external ground truth, allowing CRQ platforms to calculate defensible Annualized Loss Expectancy (ALE) and Value-at-Risk (VaR) figures for board presentations.

• Cooperation with Security Information and Event Management (SIEM) & Data Lakes: ThreatNG injects high-fidelity external context, pre-correlated Context Objects, and verified reachability telemetry into complementary solutions (enterprise SIEM platforms and data lakes). Instead of burdening analysts with uncontextualized internal alerts, ThreatNG highlights the specific external assets, staging domains, and compromised credentials that require elevated correlation, giving executive leadership clear metrics on alert reduction and triage efficiency.

• Cooperation with Security Orchestration, Automation, and Response (SOAR): ThreatNG delivers pre-correlated Context Objects and DarChain attack paths to complementary solutions (enterprise SOAR platforms) via an API. When ThreatNG discovers an exposed database or dangling CNAME record on a core business domain, the SOAR platform executes automated response workflows—updating perimeter firewall rules, deleting dangling DNS entries, and opening auditable remediation tickets in Jira to demonstrate rapid Mean Time to Remediate (MTTR) to audit committees.

• Cooperation with Cyber Asset Attack Surface Management (CAASM) & CMDBs: ThreatNG feeds external asset inventories, newly discovered subdomains, and shadow cloud infrastructure into complementary solutions (CAASM platforms and CMDBs). IT and asset management teams use this feed to reconcile external discoveries against internal records of authority, ensuring that all public-facing systems are documented to satisfy regulatory inventory requirements.

Examples of ThreatNG Helping Organizations

• Substantiating Defensible SEC Form 10-K Disclosures: Ahead of its annual regulatory filing, a publicly traded financial services firm needed to document its board's oversight of material cybersecurity risks under SEC Form 10-K Item 106. The board had previously relied on internal vulnerability scan summaries that reported over 15,000 open vulnerabilities, creating executive confusion. ThreatNG evaluated the enterprise from the outside in, identifying that only 14 vulnerabilities were publicly reachable from the internet, and only two were actively listed on the CISA KEV catalog with verified exploit scripts in DarCache eXploit. ThreatNG generated an executive report and Correlation Evidence Questionnaire that mapped these empirical findings directly to NIST CSF controls. Armed with this defensible documentation, the CISO presented a concise, framework-aligned remediation roadmap to the audit committee, enabling corporate counsel to draft an accurate, defensible disclosure that satisfied regulatory oversight without exposing the firm to disclosure liability.

• Demonstrating AI Governance Compliance Under the EU AI Act: A multinational retail conglomerate operated numerous regional subsidiaries developing generative AI applications. Compliance officers worried about potential fines under the EU AI Act because of unmonitored Shadow AI deployments. ThreatNG’s recursive external discovery and Subdomain Infrastructure Exposure module swept the conglomerate's global footprint and discovered three public-facing, unauthenticated Ollama and Langflow development servers hosted on unmonitored AWS instances in a European subsidiary. At the same time, ThreatNG’s Sensitive Code Exposure module found leaked API access keys for production model endpoints in a contractor’s public GitHub repository. ThreatNG compiled an executive forensic dossier mapping these exposures directly to the EU AI Act’s high-risk governance requirements. The enterprise immediately took the instances offline, rotated the API keys, and implemented corporate AI policies, neutralizing multi-million-euro regulatory exposure prior to formal statutory audits.

Examples of ThreatNG Working with Complementary Solutions

• Working with GRC and CRQ Platforms to Substantiate Capital Requests: A CISO needed to justify a $2.5 million cloud security budget to the board's finance committee. ThreatNG discovered multiple exposed staging environments and unmanaged cloud storage buckets across newly acquired business units. ThreatNG transmitted pre-correlated Context Objects to complementary solutions (an enterprise GRC platform and an Open FAIR-based CRQ platform). The CRQ platform ingested ThreatNG’s empirical reachability and asset data to calculate a potential Annualized Loss Expectancy of $18 million resulting from regulatory non-compliance and ransomware business interruption. The CISO presented the board with an evidence-backed business case directly linking the proposed budget to an 85 percent reduction in probable financial loss, securing unanimous budget approval.

• Working with SOAR and SIEM Platforms to Prove Audit-Ready Incident Handling: An enterprise was undergoing a comprehensive SOC 2 Type II audit requiring documented proof that critical external exposures are detected and contained within defined SLA windows. ThreatNG discovered an unmonitored development server running a vulnerable Apache gateway listed on the CISA KEV catalog. ThreatNG passed a pre-correlated Context Object to complementary solutions (an enterprise SIEM and an enterprise SOAR platform). The SIEM flagged the asset as an external critical exposure, while the SOAR system executed an automated playbook that updated perimeter firewall rules to block public access, opened an auditable Jira ticket, and archived ThreatNG’s timestamped forensic evidence package. During the audit, the enterprise presented the complete, automated workflow log, providing irrefutable technical evidence of proactive risk management and continuous control effectiveness.

Frequently Asked Questions

Why do corporate boards require outside-in attack surface data for cyber risk oversight?

Corporate boards require outside-in attack surface data because it represents the empirical ground truth seen by adversaries, regulators, and underwriters. While internal reports rely on self-reported policies and subjective surveys, outside-in discovery provides objective, unembellished evidence proving whether security controls are operational on the public internet.

How does ThreatNG support SEC Form 10-K Item 106 and Form 8-K disclosures?

ThreatNG maps external exposures, reachability metrics, and vendor dependencies directly to regulatory frameworks, generating Correlation Evidence Questionnaires (CEQs) and U.S. SEC Filings reports. This gives corporate legal and executive teams verifiable data to substantiate material risk management processes in Form 10-K filings and quickly assess external exposure during Form 8-K incident materiality determinations.

How does DarcRadar differ from traditional third-party security ratings?

Traditional security ratings often rely on subjective scoring formulas and unverified statistical correlations. ThreatNG’s DarcRadar formula uses a transparent, penalty-based scoring model grounded in deterministic evidence—evaluating confirmed reachability, active CISA KEV listings, verified exploit code in DarCache, and real dark web intelligence—ensuring that every score deduction is supported by actionable technical proof.

Immediate Actionable Verification Checklist

1. Establish an Authoritative External Inventory: Run ThreatNG across all corporate apex domains, netblocks, and brand names to build a connectorless, outside-in baseline of public digital assets, cloud environments, and acquired subsidiaries.

2. Review Executive Security Ratings via DarcRadar: Inspect ThreatNG's A through F security ratings across core exposure categories to establish baseline metrics for board risk committees.

3. Audit the Perimeter for CISA KEV and Weaponized CVEs: Use the KVEV engine and 4D Data Model to identify externally reachable software flaws with active exploits in DarCache eXploit, prioritizing patching on real entry points.

4. Generate Correlation Evidence Questionnaires (CEQs) for Compliance Audits: Produce CEQs mapped across Technical, Strategic, Operational, and Financial pillars to prepare for SEC, EU AI Act, and SOC 2 compliance assessments.

5. Feed Context Objects into Complementary GRC and CRQ Systems: Configure the delivery of pre-correlated external threat telemetry into complementary GRC and CRQ platforms to automate audit evidence gathering and calculate defensible financial loss metrics for the boardroom.