This lightning talk will cover that the concept of 'detection coverage' is a utopia in both corporate and governmental entities, as almost no one has the tooling to provide any sort of quantitative data on their detection coverage.

Vendors and unserious CISOs/blue teams try to use the otherwise excellent MITRE ATT&CK framework to establish detection coverage, but the most that this framework does is point out potential blank spots

This talk describes the European Commission approach to cloud adoption from 2013-2025 along with stories of the good, the bad and the ugly and how EC has iterated upon its risk appetite and security debt appetite over time.