Resources
Measure, change, verify.
Six texts on the distance between a diagnosis and a demonstrated reduction. They explain what measurement solves, where it ends, and which conditions make a verification defensible. They are methodology, and they serve people who will never hire GWK just as well.
The sequence
Each text answers a real objection and supports a decision. They can be read out of order, but they were written as a sequence.
01Why measuring does not reduce exposureA diagnosis does not alter the environment it describes. What measurement solves, what it never touches, and why the separation between the two matters to whoever is buying.02What has to happen between diagnosis and verificationFive steps separate a score from a demonstrated reduction. Who owns each one, and why skipping any of them invalidates the final comparison.03How to verify risk reduction without changing rulersFive conditions make two measurements comparable. Break any one and the delta measures method instead of risk, and the error never shows up in the final figure.04Why impact belongs to the scope that changedRemediating one asset does not reduce organizational exposure proportionally. Why aggregating impact requires a rule that does not yet exist, and what to report until it does.05Projection is not executionThe governance roadmap projects the effect of declared actions. What that projection demonstrates, what it does not, and why confusing the two is the easiest mistake to make.06Configurable, structural, and organizational signalsNot every exposure is resolved the same way. Three classes of signal, three different timelines, and why classifying before prioritizing saves quarters.EVA solution
About the step that comes next
The series describes the work that separates a diagnosis from a verified reduction. GWK is building EVA, for Exposure, Vulnerability and Adequacy, to cover that step. It is an ongoing project, with no closed scope and no date, and none of the six texts depends on it.On the roadmap
Discuss an assessment
If the series described a problem you have, the conversation starts from the scope you need to measure, with the limits written down before any proposal.