Increasingly sophisticated, automated cyberattacks are driving up the resource and cost expenditures for IT security. This makes it all the more important for IT managers to be able to prove the effectiveness and profitability of their investments in attack prevention. This requires that they are able to efficiently assess the company-wide IT security status and communicate the result to the management level in a comprehensible manner.