Outdated software with vulnerabilities and practices that leave organizations open to threat remains common. To protect an organization one must methodically evaluate risks, threats, and vulnerabilities.