Financial models
 * Annualized Loss Expectancy (ALE) and Return on Security Investment (ROSI) (include sensitivity ranges).
 * Monte Carlo risk (10k simulations) to show loss distribution, not just averages.
 * Real Options: stage gates for large programs (pilot → scale), valuing managerial flexibility.
 * Value at Risk (VaR) for safety & brand: convert to downtime,