Quantifying Risk: How do you measure success in security?

This piece summarizes a HackerOne conference discussion where CISOs from Slack and Hyatt describe pragmatic ways to quantify cybersecurity ROI — focusing on simple metrics (efficiency finding vulnerabilities, effectiveness of prevention via trends, and time-to-remediate), leveraging cyber insurance, and framing security stories and tactical items (pentest findings, incidents, residual risk, scope changes, challenges) for board communication.