Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Measuring Cybersecurity Value 'Sucks'

16 Dec 2023 · 1 min

Watch on YouTube

0:48

Cybersecurity success means preventing attacks that never happen, making it nearly impossible to measure. You can count breaches and losses, but not the incidents that didn't occur. The field struggles to prove its value because it can't quantify what didn't happen.

Chapters

And if we do our jobs very, very well, bad things don't happen, right? How exactly do you measure something that doesn't happen? In physics, you can't measure cold, you can only measure heat. You can't measure darkness, you can only measure light. Light. In cybersecurity, it's really easy to measure impacts and losses. It's really almost impossible to measure what didn't happen. That is the challenge that we face. And ladies and gentlemen, we suck at it.