A board member argues that assessments are unnecessary because the organization has not experienced a breach. Explain why this reasoning is weak according to the course material.

### Why this is right The material warns that unknown vulnerabilities can go unnoticed without assessment. Therefore, the absence of a known breach does not show that weaknesses are absent; it may simply mean that they have not caused visible harm or have not been identified. ### The concept An assessment is a structured evaluation, not merely a response to an incident that has already happened. It helps an organization examine its assets, threats, vulnerabilities, risks, and recommended controls. A breach-free history is not proof that future risk is zero, particularly when the material says organizations continually face multiple kinds of threats. The argument is weak because it treats past experience as complete evidence about current security conditions. ### What a good answer covers - Lack of a known breach does not prove that vulnerabilities are absent. - Assessments can identify risks before a breach occurs. - Organizations face continuing threats, according to the course material. - Assessments do not guarantee that a breach will be prevented. ### Terms - **Assessment**: A structured evaluation used to identify security-relevant conditions and recommend controls. - **Insider threat**: A risk arising from a person with legitimate organizational access. ### Remember No known breach is not the same as no known vulnerability.