ederal leaders risk falling victim to a modern cyber version of the McNamara Fallacy. Named for Defense Secretary Robert McNamara’s reliance on quantifiable metrics during the Vietnam War, it describes managing by what is easiest to count (e.g., patches applied, tickets closed and average CVSS scores) while overlooking operational reality.
What is "operational reality"? I think for businesses, it is staying in the "green," so checking the boxes for programs and policies. Whereas, in the scope of the "defender's dilemma," the defenders users these programs and policies to their advantage.