An interesting reworking of the role of the CISO and ROI for cyber criminals. I wonder what their punishment would be if they fail to meet targets.