The reporting problem

Most security reports answer a question the board did not ask. “We closed 400 issues” sounds like progress, but it does not say whether the company is safer.

A better question

Ask what it would cost an attacker to reach your most sensitive data today, and how that changed since last quarter.

How to start

Pick one goal, such as reading another tenant’s records. Measure the cost to reach it, then repeat every quarter.

What good looks like

One line on one slide: the cost to break in, up and to the right, with the fixes that moved it.