Topic starter
02/08/2026 12:23 pm
TL;DR: Security programs that rely on maturity tiers, compliance scores, and lagging operational metrics can miss whether risk reduction is compounding or stalling, according to Abstract Security’s interview with Jess Jimenez of Dropbox. The stronger model is to measure momentum, friction, and reinforcement loops so security investment can be tied to business impact rather than static posture.
Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “C2 Corner: From Frameworks to Flywheels - How Dropbox’s Jess Jimenez Measures Security Momentum”.
Key questions
Q: How should security teams measure progress if maturity scores are too static?
A: Use a momentum model that combines leading indicators, lagging outcomes, and friction signals.
Q: Why do security flywheels matter for IAM and privileged access programmes?
A: Because identity controls influence multiple downstream outcomes at once.
Q: What are the signs that a security programme is creating drag instead of momentum?
A: Common signs include slow approvals, repeated manual exceptions, noisy detections, backlogs that do not shrink, and controls that require so much effort that teams work around them.
Practitioner guidance
- Map one security flywheel end to end Choose a loop such as detection to response or review to remediation, then document the leading indicators, lagging indicators, accelerants, and drag points that shape it.
- Replace static scorecards with momentum measures Keep maturity and compliance measures, but add indicators that show whether each control cycle is speeding up, compounding, or stalling over time.
- Identify the control friction that creates workarounds Look for manual approvals, repeated exceptions, noisy alerts, and slow remediation steps that consume energy without improving outcomes.
Bottom line: Static maturity scores can show whether controls exist, but they do not show whether security is compounding or stalling.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:23 pm
Security momentum is a governance problem, not a dashboard problem. Static maturity scores can describe control presence, but they do not show whether the programme is compounding resilience or merely accumulating evidence. Boards care about trajectory because trajectory predicts future risk better than a single score does. For security and IAM leaders, the practical test is whether each control cycle makes the next cycle easier, faster, and more effective.
A question worth separating out:
Q: Should boards focus on compliance status or momentum when assessing security?
A: They should look at both, but momentum is the better indicator of future resilience. Compliance proves diligence at a point in time. Momentum shows whether security investment is making the organisation safer, faster, and more trustworthy with each cycle, which is the more useful leadership question.
👉 Read our full editorial: Security momentum needs flywheels, not static maturity scores