Cyber-attacks are increasing alarmingly, and the costs of properly defending against more sophisticated attacks are becoming out-of-reach, forcing CISOs to make tough risk-balancing decisions. The difficult prospect of knowing which cyber defenses will yield the greatest benefit is enough to stress even the most seasoned CISO. This session discusses focusing on outcomes rather than individual products and asks, is protecting critical assets more art than science?