Mental models (how to decide) are necessary for effective Cyber Security (not just what to buy or how to implement). Cyber Security without strategies is sub-optimal (I will explain with a Sun Tze Art of War strategem 謀攻). Attack Surface management is a priority & something within your control because it will make you look at things from both perspectives: Offense & Defense.