Who should make cyber risk management decisions? | Hacker News Reader