I’m a risk management professional (focused mostly on cybersecurity), but the problem with managing risk in general (cybersecurity, global warming, pandemics, etc) is that few want to spend the money and those trying to manage risk are typically marginalized or ignored because it affects profitability. Whenever people are making a decision on what projects to chose, the one hardest to measure (eg reducing risk) loses, every time.