Evidence-Based Security

Introduction

When it comes to cybersecurity, it has become more than evident in the past few decades that we, as a society, are in a perpetual arms race, which often makes it hard to discern if we could ever “win.” All too often, organizations deploy costly security controls to defend their environments from cybersecurity threats, not knowing whether these controls are in fact effective or measure their ability to provide defense. Looking at annual reports from analyst firms and market researchers, we see that security spending has been growing exponentially, but organizations don’t have enough to show for it. Security leaders called on to justify their spending and demonstrate their success in mitigating risk often struggle to do so, leaving their jobs within four years on average,¹ many times due to burnout or in the aftermath of data breaches and other attacks. These factors together point to a need to manage security in a way that can be more structured and measurable. Companies should be able to justify costs and expectations and, through this effort, truly bolster security from the inside out.

This report gives an overview of evidence-based security. It covers a hands-on framework that allows security professionals to make data-informed decisions about the people, technology, and processes that underpin the effectivity of their organizational security programs.

Applying an evidence-based approach to security means regarding security with a scientific lens. It enables security ...