I wanted to know whether a security programme can be kept completely busy and still be no safer. Activity is easy to produce and easy to show: tools bought, findings closed, reports written, certificates held. Risk reduction is neither.
Going to primary sources on 28 September 2026, NIST now analyses only the vulnerability records it judges riskiest, because submissions outgrew its capacity. Recounting from NIST's own database the growth is real, but I couldn't reproduce the 263% increase that gets quoted; it's about 2.6 times, which is roughly 160%. curl ended cash rewards after the share of reports that turned out to be real fell from over 15% to under 5%. Vendor surveys put tool counts between 45 and 83 per organisation. Where activity is simply counted, several good studies find little or no link to fewer incidents, and one hospital study found more security products went with more breaches.
Specific controls done thoroughly are a different story. Multi-factor authentication for everyone and fast patching of serious flaws both link to fewer incidents and fewer insurance claims. The compliance evidence runs both ways inside a single study: Sarbanes-Oxley attestations rarely caught the control weaknesses behind breaches, yet firms reporting effective SOX 404 control went about 175 days longer between them. I found no study at all relating ISO 27001 or SOC 2 to incident rates, so two of the schemes everyone uses are absent from the evidence in either direction.
So counting activity isn't a reliable way to tell whether security improved, and I'd stop treating it as one. That isn't the same as saying the activity is wasted. Nobody has tested whether programmes doing more have fewer incidents once you allow for size and sector, using incident data the organisation didn't generate itself.