How to Measure Anything in Cybersecurity Risk

by Douglas W. Hubbard

What risks are acceptable is often not documented, and when they are, they are stated in soft, unquantified terms that cannot be used clearly in a calculation to determine if a given expenditure is justified or not.