From tools to capabilities: designing a cybersecurity decision model
An approach for moving away from isolated product-centered cybersecurity decisions and toward capabilities the organization needs to execute.
Capabilities
More security tools do not mean more security capability
Technology can enable a capability, but the capability exists only when people, processes, decisions, controls, and evidence work together.