mnli premise: However, many information security risks cannot be adequately mitigated with technical controls because they are a function of user behavior. hypothesis: There are no information security risks that cannot be adequately mitigated with technical controls.