How to Measure Anything in Cybersecurity Risk

What Hacker News says

1. rossjudsonJun 2026
   I recommend "How to measure anything in cybersecurity risk". Really interesting read about putting actual value on security.
   thread
2. haskellandchillMay 2024
   It’s really not unquantifiable. I read “How to Measure Anything in Cybersecurity Risk” and it was an eye opener. Using a table of risks and outcomes with associated probabilities and 90% confidence intervals of dollar impacts we can quantify categories of technical debt.
   thread
3. MattPalmer1086Aug 2023
   The closest security generally gets to "quantitative" techniques is in applying risk management to threat models.

   But the way risk is managed in the industry (multiplying likelihood and impact) is completely incoherent and voodoo. See the book "How to Measure Anything in Cybersecurity Risk" [1] for a good explanation of why it doesn't work and better ways to do it.

   Which is a long way of saying, no, security doesn't use quantitative techniques mostly, but it would be possible if people understood how to measure and manage risk properly.

   [1] https://onlinelibrary.wiley.com/doi/book/10.1002/97811198923...

   Show morethread
4. haskellandchillMay 2024
   What about the Bayesian methods shown in "How to Measure Anything"? They have been applied to Cybersecurity ("How to Measure Anything in Cybersecurity Risk" in a very thorough and convincing manner. It looks like the business around it is trying to apply it to product management (https://hubbardresearch.com/shop/measure-anything-project-ma...). Basically the idea is when things are hard to measure we should not abandon quantitative scales and use qualitative ones (like t-shirt sizes) but instead use probabilities to quantify our uncertainty and leverage techniques like bayesian updates, confidence intervals, and monte carlo simulations.
   Show morethread
5. thinkmassiveMay 2022
   It reminds me of "How to Measure Anything" by Douglas Hubbard [1]

   I read "How to Measure Anything in Cybersecurity Risk" but the relevant concepts are from his original book:

   - every measurement is an approximation

   - you can determine a more accurate valuation (or probability) by thinking in terms of bets

   The book isn't primarily about negotiating, but it is about estimating based on incomplete information, which applies to all negotiations. Avoiding a round number doesn't need to be arbitrary. By calibrating your estimation process you can come up with a more precise number, which can also boost your confidence.

   The result is both having a more specific valuation in mind, and being more comfortable with the outcome regardless of whether the deal worked for fell apart.

   1: https://www.howtomeasureanything.com/books-by-douglas-hubbar...

   Show morethread