Cybersecurity: How assessing one company's risk turned into a whole new venture