Aaron PritzCEO, Reveal Risk · Cybersecurity Executive | CEO of Reveal Risk | Pharma and Healthcare Focus | Author & Speaker | Board Advisor

NIST CSF 2.0: Overfocusing on Numbers

Name: NIST CSF 2.0: Overfocusing on Numbers
Uploaded: 2024-07-25T03:40:02+00:00
Duration: 28 s
Channel: Aaron Pritz
Description: In this segment of the YouTube video "NIST CSF 2.0: Overfocusing on Numbers," the speaker cautions executives against making metrics and benchmarks the…

25 Jul 2024 · 0 min

Watch on YouTube

0:28

In this segment of the YouTube video "NIST CSF 2.0: Overfocusing on Numbers," the speaker cautions executives against making metrics and benchmarks the sole focus of cybersecurity reporting. While numbers are valuable for storytelling, an overemphasis can lead to distortion—illustrated with a fisherman exaggerating a fish’s size. The speaker advises leaders to use quantitative data to support a broader narrative rather than letting the numbers dictate the story, warning that such overreliance makes reporting slippery and prone to manipulation.

So I think numbers and benchmarks, they're always good to kind of tell a story, but if you overfocus on it, I've seen some really bad things happen on both sides of the table. And that can include like people stretching, like I'm a fisherman stretching the fish. Oh yeah, that was a 12-inch fish. No, it was a 7-inch fish. You're just overestimating. So to me, I always advise our executives, use the numbers to help you tell the story, but never make it only about the number. That's where things start to get really slippery.