# Cybersecurity Benchmarking Should Focus on Control Effectiveness, Not Budgets

DevFeed: [Cybersecurity Benchmarking Should Focus on Control Effectiveness, Not Budgets](<https://devfeed.tech/articles/sorry-cyber-you-aren-t-the-only-ones-saving-the-company-from-itself-39497.md>)

Original publisher: [Read original article](<https://www.philvenables.com/post/sorry-cyber-you-aren-t-the-only-ones-saving-the-company-from-itself>)

Author: Phil Venables

Published: 2026-06-27T12:52:02Z

Content type: opinion

Language: en

Sources: [Risk and Cyber](<https://devfeed.tech/sources/risk-and-cyber.md>)

Topics: [benchmarking](<https://devfeed.tech/topics/benchmarking.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Security & Privacy](<https://devfeed.tech/topics/security-privacy.md>)

Tags: [benchmarking](<https://devfeed.tech/tags/benchmarking.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [leadership](<https://devfeed.tech/tags/leadership.md>), [risk](<https://devfeed.tech/tags/risk.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

The article argues that cybersecurity benchmarking should assess the effectiveness of security controls and their outcomes rather than compare budgets, which are not reliably comparable. It also places cybersecurity work within the broader responsibilities shared by organizational functions.

## Source excerpt

There's still a bit of a tone in some security circles that we're somehow unique in constantly having to push back against ill-advised moves, or even outright craziness, from our business, operations, or technology colleagues. But, when you pause and think about all the many functions in your or other organizations you realize this is not so. You quickly see that while great security teams are true enablers of business and reducers of friction, most teams still have to (and are expected to...