Peter Drucker, aka the founder of modern management, is credited with writing, “If you can’t measure it, you can’t improve it.” Over time, that has been broadened to, “If you can’t measure it, you can’t manage it,” a statement that is taken as holy writ for most modern executives.
Indeed, business in the 21st century is all about metrics. Cybersecurity has plenty, measuring everything from port probes to login attempts. It’s expected that cybersecurity managers will have a good handle on all of these metrics and know what they’re saying about their organizations. But in today’s business organization, these security metrics aren’t enough.
