Exposure Management: Measure Risk, Not Just Controls

Summary

At Box, Heather Ceylan describes replacing control-completion metrics with exposure-focused risk indicators that assess exposure, remediation and prevention, helping boards prioritize action and see whether security work reduces risk.

Key points

• Heather Ceylan says Box shifted beyond control-implementation KPIs to indicators that show where cyber risk is actually exposed.
• Box assesses its top security risks through three lenses: exposure, remediation and prevention, with exposure weighted more heavily.
• Prioritization should account for reachability: an internet-facing medium-severity vulnerability may warrant more attention than an isolated critical vulnerability.
• Risk indicators can give boards a data-based view of exposure and guide investment and prioritization without relying on speculative dollar-loss estimates.
• Security priorities should map to top risks, and engineering, product, IT and other stakeholders should share responsibility for action plans and remediation.
• Red risk measures should prompt investigation and action rather than blame; compliance and successful controls alone do not establish that an organization is secure.