How do companies assess risk? It's a system-by-system question

If the security community learned anything from the SolarWinds cyberattack, it was that threat actors do a better job assessing where to find vulnerabilities than cybersecurity teams do at assessing risk. This was a supply chain attack, where one company was hacked in order to bring chaos to other, often bigger, businesses.