> One issue is that some things, like vulnerability to supply chain disruptions, are intrinsically harder to track because they are based on rare occurrences. Thus, they will tend to get sacrificed in favor of measures which are more frequent, leading to an emphasis on short-term strategies.

I suppose this is part of why "chaos engineering" has gained popularity- introducing artificial disruptions at a known rate makes it easier to quantify the impact of otherwise-unusual events.