77. Security metrics and executive communication

Builds meaningful measures for exposure, control performance, incidents, recovery, engineering work, and business risk without relying on misleading activity counts.