A cross-industry benchmark is easy to obtain and easy to cite, and it is usually the wrong comparison. A regulated financial institution and a mid-market retailer have different regulatory obligations, different threat models and different tolerance for downtime — averaging them together produces a number that describes neither.What Gets Lost in the AverageAveraging across industries smooths out exactly the variation that matters for a governance decision: an organization in a heavily regulated sector may run more control activity than the average not because it is more mature, but because its obligations demand it. Read against the cross-industry average, that organization can look over-invested when it is simply meeting a different bar.Making a Benchmark Useful Instead of ComfortingMatch on regulatory exposure first, industry second: two organizations in different industries but the same regulatory regime are a closer peer group than two in the same industry under different regimes.Match on scale and architecture: a benchmark built from enterprises with dedicated security teams says little about an organization running lean, and vice versa.Treat a favourable comparison with more scepticism than an unfavourable one: a benchmark that confirms what leadership wants to hear gets far less scrutiny than one that doesn't, which is exactly backwards.Ask what the benchmark excludes: organizations that declined to participate, or that failed and were removed from the sample, are rarely visible in the published average.“The organizations most eager to cite a favourable benchmark are usually the ones who checked least carefully whether they belong in its peer group.”When a Benchmark Is Worth UsingA benchmark earns its place in a board paper when the peer group is named and defensible, when the method of measurement is disclosed, and when the comparison is offered alongside the organization's own trend over time rather than instead of it. Absent those three conditions, a benchmark number is closer to an anecdote with a percentage sign than to evidence.Share this articleX (Twitter)LinkedInFacebookCopy Link
Benchmark StudyMay 27, 2026Benchmarking Without a Peer Group You Can TrustMost organizations cannot name, with confidence, who their real security peer group is. Benchmarking against an assumed one is common, and it is one of the quieter ways a comparison misleads.
Research ReportAug 30, 2026What 'GRC Maturity' Actually Means Before You Benchmark Against ItEvery maturity model produces a number. Very few of them agree on what the number is supposed to represent, which makes comparing your score to anyone else's a riskier exercise than it looks.
Regulatory OutlookJul 10, 2026Reading a Regulatory Outlook Without Overreacting to ItA regulatory outlook describes what could change. Treated as a description of what has already changed, it produces either premature spending or, worse, a false sense that a real change is 'just proposed' long after it has taken effect.
