Security roadmaps

A roadmap organised around tools to deploy is a procurement schedule.

It measures spending and delivery rather than risk reduction, and it survives because tools have dates and outcomes do not. A roadmap organised around risks to reduce is harder to write, harder to sell and is the one that can be judged afterwards.