A New Research Direction: The Realized Value of Cybersecurity

I am starting a second research project: Measuring and Communicating the Realized Business Value of Cybersecurity.

Why This Project

Security organizations are regularly asked what they deliver for the investment they receive. The answers I see most often describe activity (controls deployed, findings closed, coverage achieved) or estimate losses that were avoided. Those answers have their place, but they rarely describe value the business actually realized. I want to understand how that value can be measured consistently and communicated in terms that business leaders recognize.

Draft Research Question

How can security organizations consistently measure and communicate the realized business value they deliver?

This question is a starting point. I expect it to change as the literature review develops.

What Happens to Project 001

Project 001 is paused, not abandoned. The work completed so far, including the literature review, the working thesis, and the validated interview guide, remains the foundation for this platform. The two projects are related. Project 001 examines how cybersecurity decisions are made between business and security stakeholders, and Project 002 examines how the outcomes of those decisions are measured and communicated.

Next Steps

I will begin with a literature review on cybersecurity value measurement, security metrics, and value communication, then draft a proposal that defines scope and methodology.