What I have learned
Counts of blocked attacks can rise while resilience falls. I want to know which critical service could fail, how quickly we would detect it and who can restore it.
What I would do
I would review three items every week: material changes in exposure, incidents that altered assumptions, and overdue actions with named owners. I would close with one decision and a date to revisit it.