One post per incident
CISO Debrief
One post per public incident. Each takes the breach as reported, models the loss for an organization in the same position, and names the controls that would have cleared the hurdle rate. Method and assumptions on the methodology page.
Every debrief, in order
- Incident facts, cited
- Scenario and threat community
- Loss drivers
- Loss exceedance curve
- Modeled scope of loss
- Recommended controls with ROI
- Three takeaways
No debriefs published yet.