But in simple terms, a comprehensive understanding that will help to identify and avert potential vulnerabilities is not possible unless entities and regulators are systematically monitoring, disclosing and talking about these risks,” he said.