How to Prioritize Security Controls When Your Effectiveness Data Is Unreliable

A new framework argues that where you place a control in your network matters more than how well it performs — and that optimizing for the worst case might be costing you.

How do you measure the effectiveness of a security control that has never been breached? Is it 100% effective, or has it simply not been tested by a sophisticated enough adversary?

This question sits at the center of every cybersecurity budget conversation. Mathematical models for security investment rely on precise effectiveness metrics — a firewall sto…