One of the most challenging risk assessments I ever worked on involved a financial institution’s massive cloud infrastructure: the scope included everything from internal systems to customer-facing platforms, with threats ranging from cybercriminals to untrained employees. Getting started seemed daunting, especially the data collection phase.