What a CISO should really be doing to answer the inevitable question from their top management - “how safe is the company today?”.