Security Products Should Be Tested Against The Outcome, Not The Alert
A perfect alert can still lose the attack. Product testing should measure interruption, containment, analyst context and how far an attacker progresses toward business impact.
Read article →