Discussion on:

How to sell information security to management

I am a huge fan of Dr. Kahneman, read everything he published. You say most of the time "Prospect Theory" applies in what we would consider a negative way. I would appreciate learning of your sources. I am not seeing that, it seems that management is altering their perception of the perceived risk?