Security teams often report how many threats they blocked, alerts they generated, or vulnerabilities they discovered.

But do those numbers actually prove that an organization is becoming more secure?

In a TechNadu interview, Karim Hossen, CISO at EfficientIP, discusses the challenge of measuring preventive security, establishing accountability, and controlling autonomous AI systems.

Key takeaways

1. More security alerts don't necessarily mean better protection

Hossen argues that detection quality should be measured by the decisions it enables.

Metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) matter, but they need context.

The important question is whether security investments are reducing exposure and improving response.

2. More telemetry can make investigations harder

Collecting DNS, endpoint, identity, and network data is useful only when analysts can connect the information.

Correlating DNS with DHCP, IPAM, and identity data helps identify which assets and users are associated with suspicious activity.

3. The CISO shouldn't automatically own every cyber risk

When remediation affects production, revenue, or business operations, the relevant business owner needs to participate in the decision.

Organizations should establish risk owners, escalation thresholds, and exception approval authority before incidents occur.

4. AI agents cannot be accountable for their own actions

Organizations deploying AI agents remain responsible for their permissions and autonomy.

Hossen recommends human validation for high-impact actions, clear audit trails, and mechanisms to stop or reverse agent activity when necessary.

5. Some of the best security work is difficult to quantify

Architecture hardening, improved asset visibility, access controls, and resilient infrastructure may prevent incidents that never become visible.

That makes demonstrating their value more complicated than simply counting blocked attacks.

The bigger question

Security leadership involves more than deploying controls and collecting metrics. It also requires making risks understandable, assigning responsibility, and ensuring that security decisions lead to meaningful outcomes.

Full TechNadu interview:

https://www.technadu.com/defining-ciso-responsibility-when-security-success-may-be-an-incident-that-never-happens/640225/

Discussion: What metrics best demonstrate the value of preventive cybersecurity work when there is no incident to measure?

Join r/technadu for CISO perspectives, cybersecurity leadership discussions, and expert interviews.