Everything there is to find on tag: evidence-based security.
Top story
Security industry is fundamentally broken: base investments on hard evidence
Many security investments do not deliver what was expected or hoped for. Organizations can do better, however...