Measure the Value of Mitigation
It is possible to calculate the value of mitigating risk for each vendor. Value of mitigation is in terms of the reduction of mean years between data breaches. Of course mitigating vendors that contribute most to aggregate bring the most value. Below is an example mitigation table from our report. It shows the reduction in risk for mitigating the highest contributing vendors. For example, mean years between breaches decreases from 12-years to 22-years by mitigating the risk from Iron Mountain, AWS, Google and Zoom.