Integrating Cybersecurity into Risk Management: Threat Modeling and Pen Testing in Action