PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Quantifying Risk: How do you measure success in security?

hackerone.com | blog | #conference | #risk-management | #ciso | #security-metrics | #slack | #hyatt
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Slack CISO Larkin Ryder and Hyatt CISO Benjamin Vaughn discuss how they quantify security success and ROI, tying security goals to business purpose when budgets and metrics are scrutinized.
Published
Collected

Related coverage

blog · netspi.com
Measuring Security Risks Consistently
Risk labels are subjective without shared impact thresholds. The author suggests defining organization-specific fiscal, reputational, and safety impact levels in a matrix, involving multiple roles.
blog · netspi.com
Metrics: Your Information Security Yardstick
Security metrics fall into effort, result, and environment types—from training hours to days since the last breach. Tracking them proves program value and helps justify budgets to leadership.
blog · netspi.com
Secure360
A recap of the Secure360 conference in the Twin Cities, covering why risk is so hard for organizations to grasp, cloud security gaps, and using PCI DSS as a baseline for security programs.
blog · hackerone.com
Calculate Return on Mitigation (RoM) With Hai
HackerOne's AI copilot Hai now auto-calculates Return on Mitigation (RoM) for resolved reports, quantifying the losses avoided by fixing vulnerabilities before exploitation.
blog · hackerone.com
A Call for a New Cybersecurity Measurement Standard
HackerOne argues ROI fails to capture cybersecurity's value because security prevents losses rather than generating revenue, and proposes Return on Mitigation (RoM) as the new metric.
blog · hackerone.com
Measure, Compare, and Enhance Security Programs with HackerOne Benchmarks
HackerOne Benchmarks lets security teams compare response, triage, and bounty metrics against industry peers using data from 3,500+ programs, with year-over-year trends to spot weaknesses.
Back