What does the traditional pass$-$fail check$-$the$-$box model fail to address?

The financial losses due to cyber incidents

The need for compliance with industry regulations

The changing nature of cyber threats

The business rationale for cyber risk