Somewhere right now, a security team is updating a risk register it spent 18 months building, not because the threat landscape changed, but because the regulatory requirements have shifted again. They are not alone in the frustration they must be feeling. Our…