Research
Original benchmarks
Totals from assessments and questions answered on this site. We don't ask who you are or where you work, and nothing is published until the sample is large enough to mean something.
Practitioner pulse: what readers actually do
One question about practice on chosen Guidance pages, with the answers so far beside the pack's default. Results show once a question has enough answers.
In development
Security exception lifecycle practice, board reporting metrics in actual use, vulnerability remediation maturity by organisation size, and NIS2 readiness by sector.