How to Measure Anything in Cybersecurity Risk

by Douglas W. Hubbard

When we conduct a penetration test on a system, we are not changing the state of the application with this inspection; rather, we are changing our uncertainty about the state of the application.