I've been tasked with improving the security of a medium-sized digital company.
I know of a few great resources (mainly provided by OWASP), but I'm having a hard time coming across any thing that has effectively captured the monetary effect improving the security has/will have on the company.
I'm sure many people have ran across this problem before, are there any good reading suggestions for papers or the like out there?
