# Why Cybersecurity Benchmarking Should Focus on Control Effectiveness and Outcomes

DevFeed: [Why Cybersecurity Benchmarking Should Focus on Control Effectiveness and Outcomes](<https://devfeed.tech/articles/do-you-really-know-what-s-going-on-39489.md>)

Original publisher: [Read original article](<https://www.philvenables.com/post/do-you-really-know-what-s-going-on>)

Author: phil7672

Published: 2026-05-16T15:56:56Z

Content type: opinion

Language: en

Sources: [Risk and Cyber](<https://devfeed.tech/sources/risk-and-cyber.md>)

Topics: [benchmarking](<https://devfeed.tech/topics/benchmarking.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [benchmarking](<https://devfeed.tech/tags/benchmarking.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [effectiveness](<https://devfeed.tech/tags/effectiveness.md>), [leadership](<https://devfeed.tech/tags/leadership.md>), [risk](<https://devfeed.tech/tags/risk.md>), [strategy](<https://devfeed.tech/tags/strategy.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This commentary argues that cybersecurity benchmarking should emphasize the effectiveness of security controls and outcomes rather than inputs such as budgets. It also discusses the continuing waves of vulnerabilities and possible responses.

## Source excerpt

At some point every leader needs to ask themselves: Do I really know what is going on in my company? Do I even know what is really going on in my own organization? Most leaders do not know the actual truth of what is happening. This is not because people are overtly hiding things or that leaders are ineffective, although sometimes it is both of those, but rather this is because of the "thermocline of truth" that I covered in this post. Organizations are full of cultural, structural, process,...