From Atlantic Council:

Paul Rosenzweigresident senior fellow, national security & cybersecurity, R Street; founder, Red Branch Consulting: “The lack of statistics. We don’t collect data like in baseball; hence the Solarium call for a Bureau of Cyber Statistics. If you insist on an answer: median dwell time of an intruder in a system before discovery. If it is going down, we are improving.”