[collingreene]

If you like that book he wrote one about applying those ideas to this exact problem! https://www.amazon.com/How-Measure-Anything-Cybersecurity-Ri...

I've never managed to make the effort to apply his ideas with much rigor but they are definitely appealing and possibly better than the alternative of "maybe nothing".

[mindcrime]

Oh wow, I had no idea he'd written another book. I'll definitely want to check this one out at some point. Thanks for the heads-up!