Metrics: Your Information Security Yardstick

Follow-up on building security metrics: map controls to requirements, pull data from reliable sources like vulnerability management tools, then combine low-level metrics into higher-level indicators.

You cannot protect what you cannot inventory: this piece argues IT asset management underpins every security program, defining what counts as an asset and the questions organizations must answer.

A reflection on how organizations lean on technology products as a cure-all for security problems they don't understand, buying standardized solutions that create a false sense of security.

Risk labels are subjective without shared impact thresholds. The author suggests defining organization-specific fiscal, reputational, and safety impact levels in a matrix, involving multiple roles.

Preparing for an audit can be one of the best ways to fund and improve your security program, but this “stimulus package” for your compliance effort typically dwindles once an organization completes or passes an audit.

Traditional ROI struggles to capture proactive security value. HackerOne shows how Return on Mitigation (ROM) complements ROI by comparing breach costs with mitigation costs in bug bounty programs.