The math of an annual test cycle
Start with the arithmetic a CISO actually has to defend in a board meeting. If an environment is tested once a year, and the test itself takes one to three weeks to scope, execute, and report, the organization has cur
