Are We Safer Than Last Year? Your Dashboard Can’t Say
Find Threat Talks on
Your board asks a simple question: are we harder to hack than last year? Most security dashboards can’t answer it. Event counts climb when attacks rise and when detection improves, so the trend means nothing. Mean time to detect is measured in minutes while AI-driven attacks move in hours or less.
In this episode of Threat Talks, Lieuwe Jan Koning, Co-founder & CTO at ON2IT, asks Rob Maas, Field CTO at ON2IT, what to report instead. Rob’s answer comes in two parts: readiness, which shows whether management and IT are aligned behind Zero Trust, and fitness, which shows whether the controls protecting your critical assets are really in place. Both feed one score from one to five, built on criteria that are either true or false. You get a number you can defend in the boardroom, and one nobody can nudge up the week before.
What you’ll learn
- What to report instead of alert volume. Event counts rise with attacks and with better sensors, so the trend says nothing about your risk.
- Why your Zero Trust program stalls. It is rarely the technology. It is the board and IT wanting different things, or a program that rests on two engineers who could resign tomorrow.
- Which maturity level you need. Level three is enough for most organizations. Water management and IP-heavy companies facing state actors should aim higher.
Your cybersecurity experts
Lieuwe Jan Koning
Co-Founder and CTO
ON2IT
Rob Maas
Field CTO ON2IT
Episode details
Why dashboards measure the wrong thing
Security teams measure detection because the industry grew up around it. Detection was easier to deploy than prevention, which often means changing the network and the infrastructure. The result is a dashboard full of activity metrics that reward noise. Rob’s position is that mean time to detect should be sub-second, and that fast detection follows naturally once prevention is in place. Detection is step five of the five-step Zero Trust model, yet it’s where most organizations start.
Why Zero Trust programs stall
Rob names misalignment as the main reason Zero Trust projects fail. Either the board declares a Zero Trust program and IT keeps doing its own thing, or a strong IT team asks for network changes and budget and hears that it isn’t a priority. Operational teams often carry Zero Trust on the backs of a few local heroes. When one of them leaves, progress stops. A readiness questionnaire across the strategic, tactical and operational levels forces that conversation, and the alignment it produces matters more than the score itself. Without it, an organization can’t pass level one, however strong its firewall team is.
A score nobody can fudge
Fitness is where the model gets strict. Every criterion is binary: are the Protect Surfaces defined, are the transaction flows mapped, are the controls implemented and evidenced, does every Protect Surface still have an owner who works at the company? ON2IT condensed the MITRE ATT&CK framework into 32 higher-level controls to make this measurable. The same data gives the same score, whether it sits in a portal or a spreadsheet.
What to report upward
Activity metrics can live alongside a posture score: one tracks how your SOC performs, the other tracks how well you’re protected. But if you report only one thing to the board, Rob argues, it should be your posture. And a posture score decays when you stop tending it: owners leave, assessments lapse, and the number drops on its own.
Get your Hacker T-shirt
Join the treasure hunt!
Find the code within this episode and receive your own hacker t-shirt for free.
