You can estimate: https://www.wiley.com/en-us/How+to+Measure+Anything+in+Cybersecurity+Risk%2C+2nd+Edition-p-9781119892304 https://www.wiley.com/en-us/How+to+Me

You can estimate: https://www.wiley.com/en-us/How+to+Measure+Anything+in+Cybersecurity+Risk%2C+2nd+Edition-p-9781119892304 https://www.wiley.com/en-us/How+to+Measure+Anything+in+Cyber... It's just that it is not the norm, so expectations are low. Some companies consistently do better than others, so clearly it's not all down to luck.