How to Measure Anything in Cybersecurity Risk

by Douglas W. Hubbard

We believe this may be a major missing component of risk analysis in cybersecurity. We can realistically only treat past observations as a sample of possibilities and, therefore, we have to allow for the chance that we were just lucky in the past.