Cyber budgets are exploding in response to the endless escalation of cyber attacks.  But growing budgets alone will not make enterprises more secure.  Its time to think strategically about the risks (and costs) associated with cyber threats and take a strategic approach to how we identify and measure our cyber exposure and readiness, develop frameworks for prioritizing our cyber security efforts and report to management our cyber security posture and associated changes - for better or worse.  Continuous Controls Monitoring points the way...