How do we value Cybersecurity Operations? Clearly they are important, and more difficult than valuing for example the returns on an investment portfolio.
Many of us do not come up with a valuation other than a vague and weak "they matter" and perhaps an additional "a lot" or similar.
Chris Crowley introduces a much needed framework to value Cybersecurity Operations. Like most frameworks or methodologies, it is imperfect, not one size fits all, AND extremely valuable.
He includes Jupyter Notebooks that simplify "easily" adapting his work to our exact environment. I put easy in quotes, because although relatively easy from Crowley's starting point, it is both demanding and extremely valuable work!
Bravo!
I really enjoyed reading "The Value of Cybersecurity Operations". It addresses an important challenge: explaining the value of a SOC beyond simply counting alerts, incidents and activities. I especially appreciated how Christopher connects security operations with business risk, meaningful metrics and speculated loss prevention. As someone working in security operations and developing threat-informed frameworks, I found the book closely aligned with my own thinking while also helping me see the subject more clearly from an executive perspective. It is a thoughtful and valuable book for anyone who wants to demonstrate why cybersecurity operations truly matter. Highly recommended.
The Value of Cybersecurity Operations tackles one of the most important challenges facing SOC leaders: how to demonstrate the value of Security Operations in terms that make sense beyond the SOC itself.
Christopher Crowley provides a thoughtful, practical and defensible methodology for quantifying that value and aligning Security Operations with the needs of the organisation it serves. Importantly, he doesn’t pretend there is one perfect answer for every environment. Instead, he gives readers the tools and understanding needed to apply and adapt the approach intelligently.
The companion notebooks are particularly valuable, turning complex assessments into something practitioners can actually use and communicate.
Chris’s experience as a world-class instructor is evident throughout. He doesn’t simply explain concepts; he builds capability in the reader.
For SOC leaders seeking to bridge the gap between technical operations, business value and executive decision-making, this is an exceptionally useful resource.
After 30 years in cybersecurity and IT ops, I’ve sat through way too many “value of the SOC” conversations that go nowhere. Christopher Crowley’s The Value of Cybersecurity Operations is one of the few books that actually helps. It gives you practical ways to calculate loss prevention and show real business impact with the data you already have, instead of the usual FAIR/ALE/ROI hand-waving. It connects what executives care about with the day-to-day reality of running a SOC, and the included code notebooks make the methods usable right away. Straightforward, useful, and long overdue.
Great overview and start for visualization and analysis of your own SOC operations and data.
It's a rare find that bridges the gap between high-level management goals and the granular metrics that actually drive security ops. Highly recommended for anyone trying to align their SOC operations with business value.
One of the things I'm most interested in is how it connects executive priorities with the day-to-day realities and metrics of security operations. If you're interested in making your security operations more measurable and effective, it's worth checking out.
Chris is the expert I turn to when I need to understand the nuances of SOC management and operational efficiency. Distilled into his self-published book, it's a valuable read!