Protecting an organization from advanced attacks is no easy task. Year after year, breaches seem to get worse, even as we hear about improvements in security controls. CISOs are left to wonder if they need to spend more on cyber security, or if their tools or personnel are not performing as expected. Understandably, answers are unique to each organization and its security strategy.

According to Ernst and Young’s 2020 paper titled “How does security evolve from bolted on to built-in?”:

• 20% of organizations are extremely confident that cyber security risks and mitigation measures presented to them can protect the organization from major cyber attacks.
• 25% of organizations can financially quantify the effectiveness of their cyber spend.
• 26% of breaches in the past 12 months were detected by the security operations center (SOC).

This paper explores best practices for getting in front of these issues by measuring cyber security control effectiveness. It covers the origin, capabilities and selection criteria for security validation technologies.