At a higher level Agile is about delivering value end-to-end as soon as possible, repeated a lot of times. The iterative part is important, because you're suppo

At a higher level Agile is about delivering value end-to-end as soon as possible, repeated a lot of times. The iterative part is important, because you're supposed to be measuring and learning based on past deliverables. I don't know how your company organizes the security teams, but both at Yahoo and now at GoDaddy the security folks delivered a lot of software. Code scanners, patches rollout, monitoring, etc... I agree you can't exactly deliver phishing protection, but for example I've seen fake phishing emails being sent by executives, and then the security team measures if employees are taking the bait. You do that every once in a while, measuring if things are improving or not. Maybe there are other angles you can use to approach how you measure the value your team delivers.