I agree. The real value comes from incremental improvements in each area and measuring these improvements over time. Unfortunately, vast majority of security leadership don't think in terms of incremental improvements or product backlog.