Qualitative assessments of security risks are not as compelling as statistics on attacks detected, contained or not blocked. If you can't measure effectiveness of controls you won't get funded with scare tactics. It's STILL all about the data. This P2P will discuss how a risk and threat based approach to analyzing data can deliver measurements and key indicators so executives can make decisions.