They can tell you what they bought. The firewall. The antivirus. The email filter. What they can’t tell you is whether any of it is working, whether the gaps from last year are closed, or whether the number that matters most, their actual risk, is moving in the right direction.

That is the problem with how most organizations think about security. They treat it as a project. Something you do once, check off, and forget. But security was never a destination you arrive at. It is a posture you hold, and posture drifts the moment you stop paying attention.

The mindset shift

Three ideas sit underneath everything else.

Security is an ongoing process, not a set-and-forget purchase. Your attack surface grows every time you add a device, hire an employee, or turn on a new cloud app. What was enough last year can be dangerously thin today.

Security has to be woven into how you operate, not bolted on afterward. Every hire, every purchase, every onboarding step either strengthens your posture or quietly weakens it.

And most important: you cannot improve what you cannot measure. Without a way to score where you stand, “getting more secure” is a feeling, not a fact.

So how do you measure something as sprawling as security posture? You break it into dimensions you can actually see.

The four dimensions of security posture

A complete picture of your security health comes from four questions. Each one is a lens. Together they are a system.

1. Are your controls actually working? Not licensed. Not purchased. Working. This is where the first gap almost always shows up. A firewall nobody monitors is not protection. EDR that never got deployed to that one forgotten laptop is not coverage. The details matter here, and they compound: multi-factor authentication alone blocks over 99 percent of automated credential attacks, and more than 90 percent of attacks still start in the inbox.

2. Are policies being followed? The human layer is where most breaches actually happen. Verizon’s Data Breach Investigations Report puts it at 82 percent of breaches involving a human or policy element. Training completions, access reviews, policy acknowledgments. This is unglamorous work, and it is also the difference between a defensible organization and an exposed one.

3. Are known weaknesses getting fixed? Attackers do not need a zero-day when you have left the front door open for a month. Roughly 60 percent of breaches exploit vulnerabilities that are already more than 30 days old. Measuring posture here means knowing your patch windows and holding to them. Critical issues in a day or two. High within a week. Nothing important left to drift.

4. What does your history tell you? Past incidents and claims are not just scars. They are a signal. A pattern of incidents points directly at gaps in the first three dimensions, and it shapes something with real dollars attached: your insurability, your premiums, and the terms carriers are willing to offer you at all.

Why all four, together

Here is the part people miss. No single dimension tells the truth on its own.

A company can have a beautiful security stack and terrible patching habits. Another can pass every compliance check and still have no MFA on a critical account. Strength in one area does not cover weakness in another. You need all four in view at once.

And when you measure them consistently over time, you get the thing that actually matters. Not a snapshot. A trajectory. You stop asking “are we secure,” a question with no honest answer, and start asking “are we getting safer,” a question you can prove.

From four questions to one number

This is the thinking behind the Cork Cyber Score. We take these dimensions and turn them into a single, trackable baseline, the way a credit score turns your financial health into one number you can actually work with and improve over time.

The idea is simple: pick your dimensions, measure them honestly, and watch the direction of travel. The organizations that treat security as something measurable, rather than something they hope is handled, are the ones that sleep better at night.

Security is a journey. The least you can do is know where you stand on the map.

This is the first in a series where we break down how modern organizations measure, track, and improve their cyber posture. Follow along, and visit Cork’s website to learn more!