We have this at our job too. We do pentesting to prevent us having vulnerabilities and maybe even be hacked. But then the new manager wanted a KPI. In their i

We have this at our job too. We do pentesting to prevent us having vulnerabilities and maybe even be hacked. But then the new manager wanted a KPI. In their infinite wisdom the management people decided that "Cost saved by preventing a hack, in Euros per product" was going to be the KPI. So now a bunch of pentesters have to try and estimate what the impact of a potential, never happening (because we found it) vulnerability would have been on our company, if exploited by a malicious actor. After a while of guesstimating this they started giving us flack for the number going down. We tried explaining over and over again that this makes no sense as a KPI. We're just guessing essentially. But no, they want the KPI and they shall get the KPI. So now we just guesstimate the potential cost a little higher every month, but not too much.