For nearly two decades in security, I have grappled with the same recurring question from boards and stakeholders: "Are we secure?" For years, the industry standard was the qualitative heat map, ...