So the idea of the risk operation center is how do we elevate the conversation of risk? How do we take vulnerability as only one component of risk? 

second component is misconfiguration, third component is identity, bring all of that, harmonize all of that, and then get into threat intelligence, business context, remediation and compliance, all through very focused on risk itself, and then, acknowledge that risk management exercise has three components. 

One is mitigation proactively. Second is consciously accepting a certain risk. And the third is what you cannot accept and what you cannot mitigate, you need to transfer to a cyber insurance company. 

So the ROC will allow you to have a conversation with your cyber insurance company to say, here's my sustained risk level.