Deploying Komrisk – learnings and mitigations