Hello. How do you benchmark your cybersecurity spending?

Common metrics include cyber budget as a percentage of overall tech spending and cyber budget as a percentage of company revenue. I suppose these are as good as any, at least as a way to put a stake in the ground to consult over time.

But I’m not sure what these metrics really tell us.

I’d love some feedback on the subject. Are there other metrics that are inherently more meaningful? How do you use metrics? That is, when presenting to the board or C-suite? When vying for project funds? Let me know by email, or by replying to this newsletter. I'll include shrewd comments in an upcoming newsletter. Thank you!

More news below.

The U.S. National Reconnaissance Office, which helps coordinate spy satellites, said it is investigating an incident affecting its research website where potential intelligence contractors make project bids and pitches. (Reuters)

New funding: Fable Security raised $31 million from investors Greylock Partners and Redpoint Ventures. Fable, based in San Francisco, provides tools for redirecting risky employee behavior in real time. 

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten, James Rundle and Catherine Stupp. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.