Hello colleague,

I agree, IP is very hard to measure. Especially for large corporations it is impossible to monitor if competitors gained access to IP due to an incident. I don't think the measurement portion is too interesting though. If a startup develops one product, or one solution, then that's the one thing your business revolves around. If your competitors can copy your product easily, because your S3 buckets are wide open you may go bankrupt. Cybersecurity is a means to an end. Not all things may lead to you going out of business. Focus on those that could.

If I understand your last point correctly, we seem to agree on the Availability piece.