Security expert: “I’m not convinced that forward progress in and of itself is a good strategy” Successful information security programs have high visibility and support across the organization. Metrics can be complicated, especially for IT and security professionals who do not have backgrounds in business analytics or finance. A great program also has a sharp group of motivated individuals eager to take proactive steps every day to analyze and minimize known risks. If you practice what I call relentless incrementalism year after year, you’re guaranteed to make progress that speaks volumes, even when you can’t see it or touch it.”]
Source: https://securityintelligence.com/how-do-you-know-youre-making-progress-in-your-security-program/