The consequences of cyber-attacks are growing increasingly severe. And as “bad actors” become increasingly well-financed, and the “attack surface” where cyber threats are deployed becomes increasingly larger and more complex, it’s becoming practically impossible to ensure that everything is properly patched. To manage cyber risk in this context, one needs to fundamentally change the way cyber risk performance is measured. In a recently published article in the Harvard Business Review, Michael Chertoff, former secretary of U.S. Homeland Security, discusses three things companies should be doing to improve their current cyber risk measures. While there is no such thing as risk elimination, the author argues that through improved measurement and incentives, one can not only manage these technological risks, but also transform them into opportunities for a more resilient economy.