Thanks for this post, as it is a very interesting topic and solution proposed.
My 2 cents in here are just cost-related: Is it possible to leverage the ARDC structure (namely the risk management & security members) in part of this research?
Tagging @Sinkas for visibility.