https://www.pivotpointsecurity.com/balancing-objectivity-subjectivity-when-assessing-risk/