Cybersecurity Risk

The Cybersecurity Analysis Placebo: Measuring for the Illusion of Control

Dr. Bill Souza Episode 86

Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.

0:00 | 5:22

Send us Fan Mail

The adage "what gets measured gets managed" holds significant weight in cybersecurity. Organizations invest heavily in metrics, Key Performance Indicators (KPIs), and risk assessments, aiming to quantify their cybersecurity posture and demonstrate progress. However, a growing concern emerges: the "analysis placebo" effect, as highlighted by Hubbard (2014). This phenomenon suggests that the act of measuring itself can create a false sense of security, leading organizations to believe they are effectively managing risks when, in reality, they may be overlooking critical vulnerabilities.

Dr. B.