Topic starter
02/08/2026 12:23 pm
TL;DR: Security progress can stall even when controls exist, Abstract Security notes in its interview with Dropbox’s Jess Jimenez. Momentum models let security leaders see whether each control cycle reduces drag and builds leverage instead of just satisfying a benchmark.
Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “C2 Corner: From Frameworks to Flywheels - How Dropbox’s Jess Jimenez Measures Security Momentum”.
Key questions
Q: Why do security flywheels matter for IAM and privileged access programmes?
A: Because identity controls influence multiple downstream outcomes at once.
Q: What are the signs that a security programme is creating drag instead of momentum?
A: Common signs include slow approvals, repeated manual exceptions, noisy detections, backlogs that do not shrink, and controls that require so much effort that teams work around them.
Q: How should security teams measure progress if maturity scores are too static?
A: Use a momentum model that combines leading indicators, lagging outcomes, and friction signals.
Practitioner guidance
- Map one security flywheel end to end Choose a loop such as detection to response or review to remediation, then document the leading indicators, lagging indicators, accelerants, and drag points that shape it.
- Replace static scorecards with momentum measures Keep maturity and compliance measures, but add indicators that show whether each control cycle is speeding up, compounding, or stalling over time.
- Identify the control friction that creates workarounds Look for manual approvals, repeated exceptions, noisy alerts, and slow remediation steps that consume energy without improving outcomes.
Bottom line: Static maturity scores can show whether controls exist, but they do not show whether security is compounding or stalling.
Glossary terms: Security Flywheel, Momentum Metric, Drag Point, Leading indicator
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:23 pm
Security momentum is a governance problem, not a dashboard problem. Static maturity scores can describe control presence, but they do not show whether the programme is compounding resilience or merely accumulating evidence. Boards care about trajectory because trajectory predicts future risk better than a single score does. For security and IAM leaders, the practical test is whether each control cycle makes the next cycle easier, faster, and more effective.
A question worth separating out:
Q: Should boards focus on compliance status or momentum when assessing security?
A: They should look at both, but momentum is the better indicator of future resilience. Compliance proves diligence at a point in time. Momentum shows whether security investment is making the organisation safer, faster, and more trustworthy with each cycle, which is the more useful leadership question.
👉 Read our full editorial: Security momentum needs flywheels, not static maturity scores