Using cash-value as a proxy for impact gives you many benefits. Here are two particularly good ones that are relevant to planning security work: 1. It clarifie

Using cash-value as a proxy for impact gives you many benefits. Here are two particularly good ones that are relevant to planning security work: 1. It clarifies your thinking around impact. The simple exercise of sitting down and trying to put a dollar amount on the reputation damage your organization would suffer if Bad Thing were to happen will help you better understand the likelihood and potential consequences of Bad Thing. 2. It allows for more easy comparison to the costs that will be incurred while mitigating the risk. If you think the impact of Bad Thing will be "significant reputation damage", that's bad, but it doesn't help you decide how much time, effort, and money you ought to dedicate to preventing Bad Thing. Blindly chasing metrics can lead to pathological behaviour, for sure, so you need to balance that with strong cultural values, but overall I would say the security industry is terribly heavy on cultural values right now and pays little to no attention to measuring what actually matters to organizations.