I think the problem of determining whether a company is secure, given a particular attacker, is one that needs to be worked on.

Unfortunately I haven't made any progress in discovering a solution that would accurately determine if a company is secure or not.

Given that an org's security team, or even the world (in case of zero days), may not be aware of vulnerabilities that exist in a company's infrastructure, how do you solve this problem?

If anyone wants to chat about this, I'm at veeralpatel4@gmail.com