In order to get to grips with you performance over time, you really need to be taking incremental measurements of your cybersecurity. Taking a snapshot once a year to get the general idea is not sufficient if you really want to understand what areas of your business need improvement and if you're making the right choices throughout the year.

‍

A way you can sufficiently measure performance over time, is by implementing a range of different tools that you can leverage repeatedly as well as tools that can provide a consistent output as a sort of baseline that you can use.

‍

On top of that, you need a range of different playbooks that you can execute that change depending on the occurance and the context, offering consistency but also variety of approach as well. This way, you can look back at your implementation and say "Okay, this playbook that was executed this time produced these results, but the next time we executed it it only produced these results".

‍

Looking back and being able to do a 'what went well' and 'where can we improve' exercise is exactly the way to go when looking at undersatdning performance over time.

‍