Reactive instead of proactive

Risk management here is never about prevention. It’s always reacting after something happens, then locking everything down tighter.