C2 Corner: From Frameworks to Flywheels - How Dropbox’s Jess Jimenez Measures Security Momentum

The article argues that frameworks like NIST CSF and ISO and metrics such as MTTD and MTTR benchmark state but miss momentum, and recommends adopting security flywheels as a management system that ties leading and lagging indicators to accelerants and drag points to compound impact. It presents example flywheels for detection and response, vulnerability management, developer security, and compliance, and guides CISOs to invest where loops accelerate and to remove friction to better demonstrate value to leadership and build resilient, trust-enhancing programs.