Keynote: Measure Security Effectively
summary
Argues that security measurement must start from a risk register mapped to business objectives not from tools, and shows how to turn top risks (ransomware, missing patches, production data in non‑prod) into repeatable tactical and strategic metrics and time series. Recommends publishing metrics to break the ivory tower, consolidating common controls across merged units, and enforcing RACI + empowerment so accountability has authority. Gives practical wins like a phishing cadence with measured click rates and board war‑games that quickly change priorities.
AI-written summary · about
chapters (13)
- 0:00Welcome and introductions
- 1:23Developer-focused security
- 7:04Keynote speaker introduction
- 9:15Career journey and experience
- 13:42Defining the problem statement
- 16:58Board-level communication
- 19:42Avoiding common pitfalls
- 21:43Foundations for security
- 24:28Aligning leadership lenses
- 27:36Risk management and metrics
- 31:30Driving security outcomes
- 34:20Summary and closing advice
- 38:31Q&A and closing remarks
related talks
44mOpening Keynote: Prove It! Confronting Security With Data.
01h 01mKeynote - Starting a metrics program
35mMetrics That Matter: How to Choose Cloud Security KPIs for Your Business
40mCybersecurity Metrics Development for Board and Risk Committee Reporting
20mSecurity Smarts for the Self-Guided IT Professional
15mKeynote
38mKeynote: Dumping Traditional Security Teams
51mYou Can't Measure Risk