Confidence from coverage: the 4 dimensions every CISO should care about

​For a decade, we have measured security testing by exposure. But exposure describes the threat, and the threat is set by attackers, not by you. You can report it, but you can't manage it.

​Coverage is different. It describes your control: what you have tested, when, against which attacks and how deep. It is tangible, it can be measured and it can be improved, quarter by quarter. That makes it something you can plan, budget and report to the board.

​In this session, Kristof Németh, Field CISO, and Sandro Nafzger, CEO at SignalFisher, make the case for the shift from exposure to coverage. They introduce the four dimensions every CISO should care about (surface, temporal, scenario and depth) and show why they multiply rather than add. They also show how orchestrating every testing method lets you answer "Are we covered?" with confidence: "Yes, and here is where we need to focus next."

​Format: 30 minutes of talk, 15 minutes of Q&A. Online, free.