things that are hard to prove

The effectiveness in mitigating risks using many protection assessments can be very hard to prove, about the only way to prove many measures are  effective is a lack of the attacks they are supposed to prevent.  That is partially true because attacks adapt to measures.  Malware writers learn how to attack malware detection systems, etc.  Scanners of various types are more amenible to positive proof.  If a vulnerability scanner finds all the vulnerabilities, it has mitigated the risks arising from the vulnerabilities.  Managers generally do not want to hear this, they want effectiveness (of course) but reality is a harsh thing.