metrics

Good metrics change decisions. The scored answer picks a few in coverage, risk, outcomes and speed, defines each precisely, and explains what action each one triggers.

A green heatmap is the easiest thing in security to fake. Interviewers want ATT&CK used to plan and test, with coverage that means 'proven to fire on the variants we expect', not 'a rule exists'.

Analysts closing ten thousand alerts a week will miss the one that matters. The fix is not more analysts; it is fewer, better alerts and automation for the rest, measured by outcomes rather than throughput.

Write a release record with consequence-specific requirements, enforcement assumptions, measured task quality and unresolved outcomes. Name the decision owner and reopening conditions.

Separate reachable authority, forbidden proposals, gate decisions and confirmed effects. Compare designs with matched tasks, explicit denominators and uncertainty; tool counts and zero observed failures are not universal risk scores.

Build a decision brief from verified impact, tested scope, unresolved effects and concrete options. Practise a fictional release memo without inventing likelihood or repair estimates.

'Prompt injection' is a technique, not a risk entry. Entries that get funded describe a scenario, an asset, a consequence in business terms, an owner and a measurable treatment.