Jacob Revord
Veteran. Twenty years in military intelligence and enterprise security leadership. Now full-time on IO™.
In his words
I spent twenty years inside military intelligence and enterprise security leadership, and most of it watching capable leaders drown in dashboards. Every quarter produced more telemetry and less certainty. Nobody could answer the only question that really mattered: did the thing we do actually work? IO exists because that question deserves a clear answer, in writing, including the quarters where the answer is no.
The pattern was always the same. A programme would run, the completion numbers would look excellent, and the same failure would happen again six weeks later in the same department. Nobody was lying. The measurement was simply pointed at the wrong thing, at whether the activity happened, rather than whether anything changed.
IO is built to make the second question unavoidable. The measure is agreed before the work starts, the baseline is captured at approval, and the result is reported afterwards whether or not it flatters anyone. That includes us.
What he keeps arguing about.
These are the positions the product is built on. They are also, roughly, what he says on stage.
Activity is not outcome.
Most security programmes are measured by what was done, campaigns run, modules completed, tickets closed. None of it answers whether the organisation is in a better position than it was in January. If the only numbers you have are counts of your own effort, you are grading your own homework.
Orchestration without verification just moves work around faster.
Automating a programme that was never measured produces the same result sooner. Speed is only worth buying once you can tell which of the work was worth doing.
A measurement system that can only produce good news is not a measurement system.
If the tool has no way to report that an intervention failed, every number it produces is marketing. Regressions have to surface to the same audience, at the same prominence, as the improvements.
Accountability is a named person and a date, not a function.
Work assigned to a team is work assigned to nobody. Somebody accepted it, somebody owns it, and there is a date attached, otherwise there is nothing to verify against later.
The measure is agreed before the work starts.
A baseline captured after the fact can be framed either way. Agree what has to move, record where it stands at approval, and the argument afterwards is about evidence rather than interpretation.
On stage.
Jacob speaks at industry events on human risk, security culture, measurement and accountability. The full session catalogue and speaking enquiries are on his personal site.
Next step
Work with Jacob directly.
Advisory, workshops and deployments. Start with a conversation about what is actually being measured in your programme.