What is *How to Measure Anything* by Douglas W. Hubbard about?

*How to Measure Anything* challenges the myth that certain business challenges are “immeasurable,” offering a framework to quantify intangibles like customer satisfaction, organizational flexibility, and technology risk. Douglas W. Hubbard introduces **Applied Information Economics (AIE)**, a 5-step method to reduce uncertainty through measurement, Bayesian analysis, and calibrated estimates. The book emphasizes that measurement is about incremental improvement, not perfection.

Who should read *How to Measure Anything*?

Business leaders, data analysts, project managers, and decision-makers facing high-stakes uncertainties will benefit most. It’s particularly valuable for professionals in risk management, IT, finance, or policy who need to justify investments, assess ROI, or quantify abstract concepts like employee morale.

Is *How to Measure Anything* worth reading?

Yes—its practical methods, real-world case studies, and emphasis on actionable insights make it a standout resource. Critics note its technical depth in later chapters but praise its accessibility for non-experts. The 3rd edition adds updated examples and expanded tools for modern challenges.

What is Applied Information Economics (AIE)?

AIE is Hubbard’s 5-step framework: - Define the decision/problem. - Assess current knowledge. - Calculate the value of additional information. - Apply measurement tools (e.g., random sampling, controlled experiments). - Make data-driven decisions. This approach treats measurement as “uncertainty reduction” rather than absolute precision.

What are key quotes from *How to Measure Anything*?

- *“Anything can be measured”*: Rejects the notion of inherent immeasurability. - *“It’s better to be approximately right than precisely wrong”*: Prioritizes actionable insights over false certainty. - *“If you understand it, you can model it”*: Links conceptual clarity to measurability.

How does *How to Measure Anything* help with decision-making?

The book provides tools like **calibrated probability assessments** to quantify subjective uncertainty and **value-of-information calculations** to prioritize data collection. For example, Hubbard shows how to estimate the ROI of cybersecurity investments using incremental measurements.

What are criticisms of *How to Measure Anything*?

Some readers find its later chapters mathematically dense, and critics argue it oversimplifies complex social phenomena. A review notes it’s less focused on goal-setting frameworks (e.g., SMART goals) and more on measurement theory.

Can *How to Measure Anything*’s methods be applied to personal decisions?

Yes—readers use Hubbard’s techniques to quantify career risks, evaluate hobby investments, or assess health interventions. For instance, decomposing “job satisfaction” into measurable factors like commute time or feedback frequency aligns with AIE principles.

如何衡量万物

道格拉斯·W. 哈伯德

3.9(3709 Reviews)

《如何衡量万物》概述

在《如何衡量一切》（*How to Measure Anything*）一书中，道格拉斯·哈伯德（Douglas Hubbard）打破了无形资产无法量化的神话。这本书被广泛应用于从国土安全到风险投资的各个行业，它引入了连持怀疑态度的管理层都欣然接受的“五律法则”（Rule of Five）。在你的业务中，那些看似无法衡量的东西，可能正是你最大的未开发资产。

选择讲述方式

一本书，多种聆听方式。

来自《如何衡量万物》的相同理念。选择适合你的声音、深度和节奏，随时切换。

第 1 章

Measuring the Unmeasurable: The Surprising Science of Cybersecurity Risk

When Douglas W. Hubbard proclaimed that anything can be measured, cybersecurity professionals scoffed. How could you possibly quantify the likelihood of a data breach or the potential damage to an organization's reputation? Yet "How to Measure Anything in Cybersecurity Risk" has become a landmark text that transformed how organizations approach security decisions. Named one of the most influential cybersecurity books by the SANS Institute and endorsed by Jack Jones (creator of the FAIR framework), Hubbard's work challenges the industry's reliance on qualitative assessments and gut feelings. What makes this book revolutionary is its accessibility-it demonstrates that even professionals without statistical backgrounds can apply quantitative methods to dramatically improve security decision-making. In an era where cybersecurity has moved from IT concern to boardroom priority, with global spending exceeding $150 billion annually, Hubbard's approach offers a rational path through uncertainty.

第 2 章

The Measurement Myth: Redefining What It Means to Measure

The greatest obstacle to effective cybersecurity risk assessment isn't a lack of data-it's a fundamental misunderstanding of what measurement actually means. Most professionals incorrectly define measurement as producing "an exact value" with no error, when measurement should be understood as observations that quantitatively reduce uncertainty. Even scientists treat measurement as probabilistic. When physicists measure the mass of an electron, they report a range with confidence intervals, not a single perfect value. As Einstein noted, "As far as the laws of mathematics refer to reality, they are not certain; and as far as they are certain, they do not refer to reality." This perspective aligns with information theory, where information is defined as uncertainty reduction. For practical decision-making, this distinction is crucial. If you're deciding whether to invest $1 million in a new security control, you don't need to know the exact probability of a breach-you just need to know enough to make a better decision than you would without that information. Even reducing uncertainty from "somewhere between 0% and 100%" to "between 2% and 8%" could be worth millions in improved resource allocation. The Bayesian approach to probability treats uncertainty as a feature of the observer, not the thing observed. Probabilities represent "degrees of belief" that can be updated with new information. This creates a fundamental irony in cybersecurity: we use probability precisely because we lack perfect information, not despite it. As decision analysis pioneer Ron Howard stated, "The whole idea of probability is to be able to describe by numbers your ignorance or equivalently your knowledge." When measuring cybersecurity, we must first clarify what we're actually measuring. The "clarification chain" shows that anything worth caring about must be detectable, quantifiable, and therefore measurable. By asking "What do you mean by X?" and "Why do you care?", vague concepts like "damage to reputation" become measurable. Understanding why we measure something helps define what we're measuring, as measurements should always support decisions.

边听边看，每个词都清晰呈现

轻松跟读，《如何衡量万物》中的每个词都会随音频实时高亮。

第 3 章

The Rapid Risk Audit: Your First Step Into Quantitative Security

Imagine it's your first day as a new CISO. You have no staff, no budget, and the CEO wants to know: "What's our cyber risk exposure?" The Rapid Risk Audit provides a structured approach that's only marginally more complex than traditional risk matrices but exponentially more valuable. Following Admiral Wayne Meyer's philosophy "Build a little. Test a little. Learn a lot," this approach creates a quantitative model using just six key elements: Assets (things that create value), Threats (things that compromise value), Likelihood (chance of successful compromise), Impact (monetary loss when compromise occurs), Controls (things that reduce likelihood or impact), and Confidence Intervals (representing uncertainty). The process is straightforward: identify interview sources; define assets using organizational structure; define threats using a starter list; assess likelihoods for each threat/asset combination; estimate 90% confidence intervals for potential losses; compute Annual Expected Losses (AEL); sum all AELs; and use the output to prioritize threats. The entire process can be completed in just a couple of hours. Organizations already have more data available than they realize. Insurance premiums should roughly align with your Annual Expected Loss calculations. Ransomware payments average around $530,000 (typically 0.7-5% of revenue). Data breach costs can be estimated per record, with costs decreasing as breach size increases. Business disruption impacts range from $100/minute for small companies to $5,600/minute for larger ones. The rapid audit relies on expert judgment but replaces ambiguous "high/medium/low" ratings with actual quantities-probabilities and dollar impacts. This approach represents uncertainty in a way that allows for clear communication and updates with new information. While some resist quantifying probabilities, subjective probability assessment is mathematically valid and can be improved through calibration training. For multi-year security investments, standard financial calculations like present value should be applied. The resulting Loss Exceedance Curve (LEC) provides a comprehensive visualization of risk by showing the probability of exceeding various loss amounts in a specific period. Unlike traditional risk matrices, LECs allow for mathematical combination of risks, showing precisely how multiple smaller risks compare to larger ones.

第 4 章

The Analysis Placebo: Why Most Risk Assessment Methods Fail

Have you ever watched a security analyst confidently rate a risk as "medium" on a 5-point scale? That confidence may be entirely misplaced. Research shows that additional analysis often increases confidence without improving actual performance-what Hubbard calls an "analysis placebo." Studies across multiple fields demonstrate this effect: sports fans given more team information became more confident but no more accurate; psychologists gathering more patient information increased their confidence but not diagnostic accuracy; investors with more stock information felt more confident but didn't improve returns. Cybersecurity is unlikely to be immune to these cognitive biases. Even more concerning, research by Paul Meehl and others has consistently shown that simple statistical models outperform human experts across diverse fields. After reviewing nearly 150 studies, Meehl concluded that no other social science finding showed such uniform results across so many domains. Even in fields like oil exploration and NASA project management, quantitative methods produced estimates with less than half the error of expert judgment alone. Why does this happen? Humans make inaccurate interpretations of probabilistic feedback, creating an "illusion of learning" where they assume experience translates to improved performance. We're "deterministic thinkers with an aversion to probabilistic strategies that accept the inevitability of error." Cybersecurity experts rarely enjoy the conditions necessary for learning from experience: consistent feedback, immediate feedback, and unambiguous feedback. The most popular risk assessment method in cybersecurity-the risk matrix using ordinal scales for likelihood and impact-has become ubiquitous, with 61% of organizations using them. Yet there isn't a single study showing these matrices actually reduce risk or improve judgment over expert intuition alone. In fact, research suggests they may introduce additional errors. Risk matrices suffer from fundamental mathematical problems, including "range compression" where continuous values are reduced to discrete categories, creating extreme rounding errors. This leads to two alarming problems: very different risks can appear identical on the matrix, and "rank reversal" occurs when higher actual risks appear less serious than lower ones. Tony Cox argues these properties make risk matrices "worse than useless"-potentially worse than randomly prioritizing risks.

从《如何衡量万物》中收获更多

每日获取新洞见，探索 10 万+ 条课程内容
文字实时高亮，与音频同步
保存你的书库，在所有设备上随时访问

第 5 章

Calibrated Estimates: The Foundation of Better Forecasting

If expert judgment is flawed and risk matrices don't work, what's the alternative? The answer lies in calibrated probability estimates-a skill that can be taught and measured through systematic practice and feedback. This approach has proven far more reliable than traditional expert opinions or qualitative risk assessments. Research by Kahneman, Tversky and others reveals most people are naturally poor at calibrating probability estimates, with most being overconfident. When asked to provide 90% confidence intervals (ranges they're 90% confident contain the correct answer), most experts' ranges contain the correct answer only 40-50% of the time. For example, when engineers estimate project completion times with 90% confidence, actual completion times fall outside their ranges in more than half of cases. This overconfidence extends to binary events as well, where events rated as "99% certain" typically occur only 85% of the time. Fortunately, calibration is a learnable skill through structured practice. Through repetitive testing with quick feedback, 80% of participants become ideally calibrated after just five exercises. These exercises typically involve making numerous estimates and receiving immediate feedback on accuracy. Another 10% show significant improvement without reaching ideal calibration, usually requiring more practice or different techniques. The remaining 10% show no improvement at all-typically those who aren't relevant experts or decision makers for particular problems, or those who resist the systematic approach. Several proven techniques can improve calibration. The "equivalent bet test" involves pretending to bet significant money on your estimates - would you bet $10,000 that you're right? This forces more careful consideration of uncertainty. Identifying specific arguments against your estimates helps counter confirmation bias. Treating each bound of a confidence interval as a separate binary question (Is it definitely above X? Definitely below Y?) improves range estimates. The "absurdity test" starts with an extremely wide range where you're virtually certain the answer lies, then gradually narrows it until you feel any further narrowing would sacrifice confidence. Beyond addressing overconfidence, additional methods can further improve subjective estimates. Having multiple independent experts estimate the same thing reduces inconsistency-two experts have 71% of the inconsistency of one expert, four experts have 50%. This "wisdom of crowds" effect works best when experts make estimates independently before any discussion. Having the same expert make judgments again after several days without seeing previous estimates also helps reduce random variation and systematic biases. Surprisingly, commonly used approaches like open group discussions to build consensus perform poorly compared to algorithmic methods that combine estimates using formulas. Group dynamics often lead to polarization or deference to authority rather than better estimates. Philip Tetlock's research found that team composition matters significantly-groups of "belief updaters" who willingly change positions based on new information outperform other collaborators by 30-40%. These individuals tend to be more numerate, actively open-minded, and comfortable with probability concepts. Modern forecasting systems now combine these approaches - using calibrated experts, multiple independent estimates, and algorithmic aggregation - to achieve significantly better accuracy than traditional methods. Organizations implementing these systems typically see a 20-30% improvement in forecasting accuracy within the first year.

第 6 章

Bayesian Methods: Making the Most of Limited Data

"We don't have enough data to measure this" is perhaps the most common objection to quantitative cybersecurity risk assessment. Yet Bayesian methods allow us to update our uncertainty with new observations, even when data is limited. This approach is particularly valuable in cybersecurity, where threat landscapes evolve rapidly and historical data quickly becomes outdated. Unlike conventional statistics that assume no prior knowledge, Bayesian approaches leverage expert insights to make inferences from very little data. The approach begins with a prior belief (based on calibrated expert judgment), then updates this belief as new evidence arrives. This is especially useful in emerging threat scenarios where historical data may be sparse or nonexistent, such as evaluating new attack vectors or defensive technologies. Consider evaluating whether multifactor authentication (MFA) reduces data breaches by 90% as vendors claim. Starting with a 60% prior belief that MFA works as advertised, we can update this belief based on observations. After one firm implements MFA and has no breaches for a year, our belief increases slightly to 62.26%. With 12 company-years without breaches, our confidence jumps to 93.58%, and the estimated breach probability drops from 4.6% to 1.58%. This demonstrates how Bayesian updating can quantify the effectiveness of security controls even with limited deployment history. The beta distribution provides a powerful tool for estimating population proportions with minimal data. Using the example of assessing data breach probability, we can start with an uninformative prior (where all probabilities between 0% and 100% are equally likely), then update based on observations. For example, with 2 breaches observed in 120 company-years, we get a 90% confidence interval of 0.7% to 5.1% annual breach probability rather than assuming exactly 1.67%. This approach is particularly valuable when assessing rare events like major security incidents. This approach significantly changes risk assessment by accounting for uncertainty. When using a range of 0.7% to 5.1% breach probability instead of a fixed 1.67%, the chance of experiencing more than three breaches in 120 company-years increases from 14% to 33%. This "rotates" the loss exceedance curve, increasing the probability of extreme losses while maintaining the same mean-acknowledging that past observations are merely samples of possibilities. This more nuanced view helps organizations better prepare for worst-case scenarios while maintaining realistic expectations about average outcomes. Bayesian methods also excel at incorporating multiple data sources. For instance, when evaluating ransomware risks, we can combine industry statistics, peer experience, internal incident data, and expert judgment about our security posture. As new information arrives - whether from threat intelligence feeds, security assessments, or actual incidents - we can systematically update our risk estimates without throwing away previous insights. The practical implications of Bayesian analysis extend beyond risk assessment to resource allocation. By quantifying uncertainty ranges rather than point estimates, organizations can better evaluate the potential return on security investments and make more informed decisions about control implementation priorities.

边听边看，每个词都清晰呈现

轻松跟读，《如何衡量万物》中的每个词都会随音频实时高亮。

第 7 章

Decomposing the Seemingly Unmeasurable

When faced with seemingly impossible estimation challenges like "$0 to $500 million" potential losses, decomposition offers a systematic way forward. Breaking down ambiguous outcomes into manageable components allows for more precise analysis and better-informed decisions. This approach transforms overwhelming uncertainties into smaller, more tractable problems that can be evaluated individually. A common decomposition strategy employs the "C, I, and A" framework-Confidentiality (improper disclosure), Integrity (data/system modification), and Availability (system outages). By separating these impacts, analysts can leverage specific knowledge about systems, such as user counts, business processes supported, and potential productivity impacts. For example, an availability impact could be decomposed into lost employee productivity hours, customer transaction delays, and direct revenue losses from system downtime. Effective decomposition should follow three core principles that improve estimation accuracy: factors must be clear (unambiguous), observable (possible to detect), and useful (relevant to decisions). When applying these tests to common security metrics like "threat actor skill level" or "security maturity," many fail-they're often ambiguous, impossible to observe directly, and don't clearly inform actions. Instead, focusing on measurable factors like "time to detect incidents" or "percentage of systems with current patches" provides more actionable insights. Not all decompositions improve estimates. An informative decomposition leverages specific knowledge about your environment, while uninformative ones introduce speculative factors you know less about than the original problem. For example, decomposing risk based on internal systems and records is helpful because you have direct access to this information. In contrast, estimating state-sponsored attacker numbers or capabilities introduces more uncertainty than it resolves. Consider reputation damage-often cited as an "immeasurable" cybersecurity risk. Multiple studies before 2008 showed minimal stock price impacts from breaches, and analysis of major breaches between 2007-2016 (T.J. Maxx, Anthem, Target, Home Depot) found no discernible effect compared to previous volatility. However, more recent data shows some companies do experience significant stock impacts. SolarWinds saw a 40% stock price drop following their 2020 breach, while Equifax's stock fell 31% after their 2017 incident. In contrast, Adobe, Marriott, and Merck remained relatively unaffected despite serious breaches, demonstrating the variability of reputational impacts. For most organizations, reputation damage might be better modeled as "penance projects"-specific, measurable expenses incurred to limit long-term reputation damage. These include new cybersecurity investments (often 2-3x previous budgets), management replacements, public relations campaigns (typically $1-5 million for major incidents), customer notification and credit monitoring services ($10-50 per affected customer), and marketing efforts to offset potential business losses. This decomposition transforms an abstract "reputation cost" into concrete, estimable components that can be more accurately assessed and budgeted. The key to successful decomposition lies in identifying components that reduce uncertainty rather than amplify it. Focus on factors where your organization has data, experience, or reliable external benchmarks, and avoid introducing speculative elements that add complexity without improving accuracy.

第 8 章

Toward Security Metrics Maturity: Building an Enterprise Approach

As organizations seek to improve their cybersecurity posture, they need both an assessment of their current state and a vision for future development. This improvement must be continuous and measurable-the essence of metrics. Organizations must recognize that security metrics maturity doesn't happen overnight but evolves through distinct stages of capability and sophistication. Unlike conventional analytics maturity models, the approach presented by Hubbard and Seiersen doesn't require extensive data or capabilities to begin. The quantitative methods are particularly valuable at the early stages, helping define necessary investments for program maturation. Even basic metrics like incident response times, patch deployment rates, and vulnerability discovery counts can provide actionable insights. The authors advocate for a decision-first approach rather than rushing to implement big data solutions or data science initiatives that might distract from making immediate security improvements. This means focusing on metrics that directly support critical security decisions, rather than collecting data simply because it's available. After investing in enterprise security capabilities, functional security metrics (FSMs) help determine their effectiveness. These metrics optimize key operational security areas through KPIs related to coverage, configuration, and risk reduction within specific domains. For example, FSMs might track endpoint protection coverage, firewall rule effectiveness, or identity management compliance rates. These measurements should align with business objectives while providing clear visibility into security control effectiveness. BOOM (baseline objectives and optimization measurements) is a core metrics framework consisting of five key metrics: Burndown (rate of risk removal over time), Survival (time-to-live of risk), Arrival (rate of risk appearance), Wait-times (time between risk arrivals), and Escapes (rate of risk movement). Each metric serves a specific purpose - Burndown shows remediation efficiency, Survival indicates risk persistence, Arrival tracks new threat emergence, Wait-times measure threat frequency patterns, and Escapes monitor control failures. Together, these metrics provide a comprehensive approach to measuring security effectiveness from different angles. Security Data Marts (SDMs) are subject-matter-specific, immutable data stores that enable cross-program effectiveness measurement across security domains. They serve as centralized repositories for security-relevant data, maintaining historical records that can reveal long-term patterns and trends. Unlike traditional security tools, SDMs can answer critical questions about how security controls work together, identify redundancies, and measure previously hidden risks. They excel at determining how long malicious activity exists before detection-addressing the uncomfortable truth that security solutions are always playing catch-up to threats. SDMs can track metrics across multiple security tools and processes, providing a holistic view of security performance. Prescriptive analytics represents the highest level of analytics maturity, building upon descriptive and predictive approaches to recommend optimal actions. It involves running multiple models from both data and decision science realms to provide optimized recommendations. For instance, prescriptive analytics might suggest the most effective order for patch deployment based on risk levels, resource constraints, and business impact. The analytics hierarchy progresses from descriptive analytics (basic aggregates like month-over-month risk metrics), to predictive analytics (using past data to forecast potential outcomes), to prescriptive analytics that can propose and sometimes dynamically make decisions. Each level builds upon the previous, creating a more sophisticated and capable security metrics program.

从《如何衡量万物》中收获更多

每日获取新洞见，探索 10 万+ 条课程内容
文字实时高亮，与音频同步
保存你的书库，在所有设备上随时访问

第 9 章

A Call to Action: Redefining Cybersecurity Around Risk

The cybersecurity field stands at a critical crossroads. The unprecedented interconnectedness of companies, vendors, and government agencies has created a "total network risk" that hasn't been fully exploited yet but harbors catastrophic potential. The risk of "the Big One"-an extensive, coordinated cyberattack affecting multiple large organizations across countries-has increased significantly, with recent incidents like SolarWinds and Log4j demonstrating how vulnerabilities can cascade through supply chains and affect thousands of organizations simultaneously. Cybersecurity must be redefined around quantitative risk management, evolving beyond the current collection of tactical responses and technical controls to become a formalized, strategic program. The Cybersecurity Risk Management (CSRM) function requires positioning as a C-level function reporting directly to the CEO or board-not subordinate to the CIO/CTO, which creates an inherent conflict of interest akin to "the fox watching the henhouse." This independence ensures unbiased risk assessment and appropriate prioritization of security investments. The CSRM charter encompasses several critical responsibilities: conducting comprehensive risk reviews of all major technology initiatives, continuously monitoring the effectiveness of existing control investments, implementing proven quantitative methods that incorporate specific probabilities and dollar impacts, establishing and maintaining corporate risk tolerances, managing exception programs for business-critical deviations, and overseeing cyber insurance policies. This approach replaces traditional ordinal scales and subjective assessments with data-driven analysis and financial metrics that executives can understand and act upon. The organizational structure supporting this vision requires four key functional areas: • Quantitative Risk Analysis: Staffed by highly-compensated analysts combining advanced quantitative skills with business acumen, capable of modeling complex scenarios and translating technical risks into business impacts • Training and Development: Focused on building quantitative risk DNA throughout the organization, from executive education to analyst certification programs • Analytics Technology: Managing sophisticated big data infrastructure, real-time stream analytics, and cloud-deployed solutions for risk monitoring and assessment • Program Management: Coordinating complex risk management activities across multiple organizations, ensuring consistent methodology application and effective communication While many security professionals resist assigning quantitative probabilities-often claiming it's impossible while paradoxically having no issue with assigning qualitative ratings like "medium" or "2" to likelihood-research in decision science demonstrates that subjective probability estimation is both possible and measurable. Studies in fields ranging from weather forecasting to intelligence analysis show that trained estimators can provide reliable probabilistic assessments. The evidence is compelling: quantitative methods consistently outperform traditional approaches in accuracy and decision support value. As Ron Howard, the pioneer of decision analysis, insightfully observed: "No one has ever made a decision because of a number. They make a decision because they're convinced." The true power of quantitative cybersecurity risk assessment lies not merely in the numbers themselves but in how these numbers enable more informed, confident decisions in the face of uncertainty. This approach provides a common language between security professionals, business executives, and board members, facilitating better resource allocation and risk management strategies. In today's increasingly complex threat landscape, where attacks are becoming more sophisticated and far-reaching, these better decisions may be our only effective defense against the Big One.

★★★★★

你已读完《如何衡量万物》

深受 100 万+ 学习者喜爱

“坚持使用 23 天了，我每天都会打开它。它现在已经成为我的日常习惯。”

jayallen

《如何衡量万物》核心主题

uncertainty reduction
quantitative risk assessment
probabilistic decision making
applied information theory
calibrated expert judgment

《如何衡量万物》经典语录

Anything worth caring about must be detectable, quantifiable, and therefore measurable.
Information is defined as uncertainty reduction.
The whole idea of probability is to be able to describe by numbers your ignorance.
Research shows that additional analysis often increases confidence without improving actual performance.
We're deterministic thinkers with an aversion to probabilistic strategies.

《如何衡量万物》主要人物

Douglas W. HubbardAuthor and creator of quantitative methods
Jack JonesCreator of the FAIR framework
Ron HowardDecision analysis pioneer
Wayne MeyerAdmiral whose philosophy guides the audit process

关于作者

Douglas W. Hubbard 是畅销书《数据化决策：分析无形资产的商业价值》（How to Measure Anything: Finding the Value of Intangibles in Business）的作者，也是风险管理和定量决策领域的顶尖专家。作为一名管理顾问及 Hubbard Decision Research 的创始人，他开发了应用信息经济学（AIE）方法论，该方法结合了贝叶斯分析、蒙特卡罗模拟和数据驱动方法，旨在解决复杂的商业问题。

他的著作挑战了传统的风险管理实践，强调可衡量的结果优于直觉驱动的方法。Hubbard 的其他代表作包括《风险管理的失败》（The Failure of Risk Management）和《如何衡量网络安全风险中的一切》（How to Measure Anything in Cybersecurity Risk），这两本书均为精算考试的必读书目，并被麻省理工学院（MIT）和芝加哥大学等高校的课程所采用。

凭借在网络安全、金融和制药等行业超过 30 年的咨询经验，Hubbard 已为财富 500 强企业进行了 100 多项风险/回报分析。他的著作在全球销量超过 13 万册，并被翻译成八种语言。作为英国皇家艺术学会会士及 2017 年“网络安全名人堂”（Cybersecurity Canon Award）奖项获得者，Hubbard 的框架得到了从美国国防部到全球学术机构的广泛认可。《数据化决策》至今仍是专业人士寻求量化棘手商业挑战的基石之作。

下载《如何衡量万物》摘要

免费获取《如何衡量万物》摘要的 PDF 或 EPUB 版本。可打印或随时离线阅读。

用户还喜欢

Measure What Matters : OKRs

John Doerr

Failure of Risk Management

Douglas W. Hubbard

How Will You Measure Your Life?

Clayton M. Christensen

How to lie with statistics

Darrell Huff

HBR Guide to Data Analytics Basics for Managers

Harvard Business Review

The Data Detective

Tim Harford

The Science of Measurement: Decoding the Test 书籍封面

17 sources

The Science of Measurement: Decoding the Test

The Model Thinker

Scott E. Page

关于本书的常见问题

该学习计划的一部分

学习计划

Learn Philanthropic Cost-Benefit Analysis

5 h 32 m•4 集数

发现更多

学习计划

Master Probability in Life, Work & Business

In an increasingly unpredictable world, the ability to quantify risk and think statistically is a critical competitive advantage. This plan is designed for professionals and decision-makers who want to replace guesswork with data-driven confidence and sharper mental models.

5 h 2 m•4 章节

学习计划

The Hidden Laws of Human Behavior

This plan is essential for anyone seeking to bridge the gap between subconscious impulses and intentional action. It is ideal for leaders, educators, and individuals looking to master self-regulation and influence through a scientific lens.

2 h•5 章节

学习计划

The Mechanics of Personal Influence

This plan is essential for professionals navigating competitive environments where technical skill alone isn't enough. It provides a strategic framework for leaders and aspiring managers to master the unspoken rules of power, reputation, and psychological leverage.

3 h•6 章节

学习计划

The Maverick's Guide to High-Stakes Influence

In modern organizations, merit alone isn't enough to move the needle on bold ideas. This guide is designed for ambitious leaders and intrapreneurs who need to navigate political minefields and master the art of psychological persuasion to achieve results.

1 h 12 m•3 章节

学习计划

Master thinking in distributions

In an increasingly complex world, the ability to quantify uncertainty is a superpower for leaders and analysts. This plan bridges the gap between raw statistics and practical decision-making for anyone looking to master risk.

5 h 42 m•4 章节

学习计划

The Human Book: Decoding Hidden Intent

In an era of complex communication, understanding what remains unsaid is a critical competitive advantage. This plan is essential for leaders, negotiators, and recruiters who need to master behavioral baselines, facial analysis, and linguistic markers to navigate high-stakes interactions.

1 h 30 m•3 章节

学习计划

The Management Shadow: Taleb/Kahneman/Greene

In an era of radical uncertainty, traditional management frameworks often fail because they ignore human irrationality and the impact of rare events. This plan is designed for leaders and strategists who want to master the hidden psychological and systemic forces that govern success and power.

4 h 43 m•4 章节

学习计划

The Science of Workplace Motivation

Understanding the mechanics of human drive is essential for leaders looking to foster high-performance cultures. This plan is ideal for managers and HR professionals who want to move beyond surface-level perks and leverage psychological and biological insights to truly engage their teams.

1 h 30 m•3 章节

由哥伦比亚大学校友在旧金山创建

LOVED BY

1,000,000+ curious minds.

4.7

avg rating

1M+ learners

"Instead of endless scrolling, I just hit play on BeFreed. It saves me so much time."

@Moemenn

"I never knew where to start with nonfiction—BeFreed’s book lists turned into podcasts gave me a clear path."

@Chloe, Solo founder, LA

117

"Perfect balance between learning and entertainment. Finished ‘Thinking, Fast and Slow’ on my commute this week."

@Raaaaaachelw

"Crazy how much I learned while walking the dog. BeFreed = small habits → big gains."

@Matt, YC alum

108

"Reading used to feel like a chore. Now it’s just part of my lifestyle."

@Erin, Investment Banking Associate , NYC

254

"Feels effortless compared to reading. I’ve finished 6 books this month already."

@djmikemoore

"BeFreed turned my guilty doomscrolling into something that feels productive and inspiring."

@Pitiful

4.5K

"BeFreed turned my commute into learning time. 20-min podcasts are perfect for finishing books I never had time for."

@SofiaP

"BeFreed replaced my podcast queue. Imagine Spotify for books — that’s it. 🙌"

@Jaded_Falcon

201

"It is great for me to learn something from the book without reading it."

@OojasSalunke

"The themed book list podcasts help me connect ideas across authors—like a guided audio journey."

@Leo, Law Student, UPenn

483

"Makes me feel smarter every time before going to work"

@Cashflowbubu

查看更多网络上关于 BeFreed 的讨论

由哥伦比亚大学校友在旧金山创建

LOVED BY

1,000,000+ curious minds.

4.7

avg rating

1M+ learners

"Instead of endless scrolling, I just hit play on BeFreed. It saves me so much time."

@Moemenn

"I never knew where to start with nonfiction—BeFreed’s book lists turned into podcasts gave me a clear path."

@Chloe, Solo founder, LA

117

"Perfect balance between learning and entertainment. Finished ‘Thinking, Fast and Slow’ on my commute this week."

@Raaaaaachelw

"Crazy how much I learned while walking the dog. BeFreed = small habits → big gains."

@Matt, YC alum

108

"Reading used to feel like a chore. Now it’s just part of my lifestyle."

@Erin, Investment Banking Associate , NYC

254

"Feels effortless compared to reading. I’ve finished 6 books this month already."

@djmikemoore

"BeFreed turned my guilty doomscrolling into something that feels productive and inspiring."

@Pitiful

4.5K

"BeFreed turned my commute into learning time. 20-min podcasts are perfect for finishing books I never had time for."

@SofiaP

"BeFreed replaced my podcast queue. Imagine Spotify for books — that’s it. 🙌"

@Jaded_Falcon

201

"It is great for me to learn something from the book without reading it."

@OojasSalunke

"The themed book list podcasts help me connect ideas across authors—like a guided audio journey."

@Leo, Law Student, UPenn

483

"Makes me feel smarter every time before going to work"

@Cashflowbubu

"Instead of endless scrolling, I just hit play on BeFreed. It saves me so much time."

@Moemenn

"I never knew where to start with nonfiction—BeFreed’s book lists turned into podcasts gave me a clear path."

@Chloe, Solo founder, LA

117

"Perfect balance between learning and entertainment. Finished ‘Thinking, Fast and Slow’ on my commute this week."

@Raaaaaachelw

"Crazy how much I learned while walking the dog. BeFreed = small habits → big gains."

@Matt, YC alum

108

"Reading used to feel like a chore. Now it’s just part of my lifestyle."

@Erin, Investment Banking Associate , NYC

254

"Feels effortless compared to reading. I’ve finished 6 books this month already."

@djmikemoore

"BeFreed turned my guilty doomscrolling into something that feels productive and inspiring."

@Pitiful

4.5K

"BeFreed turned my commute into learning time. 20-min podcasts are perfect for finishing books I never had time for."

@SofiaP

"BeFreed replaced my podcast queue. Imagine Spotify for books — that’s it. 🙌"

@Jaded_Falcon

201

"It is great for me to learn something from the book without reading it."

@OojasSalunke

"The themed book list podcasts help me connect ideas across authors—like a guided audio journey."

@Leo, Law Student, UPenn

483

"Makes me feel smarter every time before going to work"

@Cashflowbubu

"Instead of endless scrolling, I just hit play on BeFreed. It saves me so much time."

@Moemenn

"I never knew where to start with nonfiction—BeFreed’s book lists turned into podcasts gave me a clear path."

@Chloe, Solo founder, LA

117

"Perfect balance between learning and entertainment. Finished ‘Thinking, Fast and Slow’ on my commute this week."

@Raaaaaachelw

"Crazy how much I learned while walking the dog. BeFreed = small habits → big gains."

@Matt, YC alum

108

"Reading used to feel like a chore. Now it’s just part of my lifestyle."

@Erin, Investment Banking Associate , NYC

254

"Feels effortless compared to reading. I’ve finished 6 books this month already."

@djmikemoore

"BeFreed turned my guilty doomscrolling into something that feels productive and inspiring."

@Pitiful

4.5K

"BeFreed turned my commute into learning time. 20-min podcasts are perfect for finishing books I never had time for."

@SofiaP

"BeFreed replaced my podcast queue. Imagine Spotify for books — that’s it. 🙌"

@Jaded_Falcon

201

"It is great for me to learn something from the book without reading it."

@OojasSalunke

"The themed book list podcasts help me connect ideas across authors—like a guided audio journey."

@Leo, Law Student, UPenn

483

"Makes me feel smarter every time before going to work"

@Cashflowbubu

查看更多网络上关于 BeFreed 的讨论

开启你的学习之旅，就是现在

第 9 章

如何衡量万物

概述《如何衡量万物》概述

一本书，多种聆听方式。

Measuring the Unmeasurable: The Surprising Science of Cybersecurity Risk

The Measurement Myth: Redefining What It Means to Measure

边听边看，每个词都清晰呈现

The Rapid Risk Audit: Your First Step Into Quantitative Security

The Analysis Placebo: Why Most Risk Assessment Methods Fail

从 《如何衡量万物》中收获更多

Calibrated Estimates: The Foundation of Better Forecasting

Bayesian Methods: Making the Most of Limited Data

边听边看，每个词都清晰呈现

Decomposing the Seemingly Unmeasurable

Toward Security Metrics Maturity: Building an Enterprise Approach

从 《如何衡量万物》中收获更多

A Call to Action: Redefining Cybersecurity Around Risk

你已读完 《如何衡量万物》

《如何衡量万物》核心主题

《如何衡量万物》经典语录

《如何衡量万物》主要人物

关于作者

下载《如何衡量万物》摘要

用户还喜欢

关于本书的常见问题

What is How to Measure Anything by Douglas W. Hubbard about?

Who should read How to Measure Anything?

Is How to Measure Anything worth reading?

What is Applied Information Economics (AIE)?

该学习计划的一部分

Learn Philanthropic Cost-Benefit Analysis

发现更多

1,000,000+ curious minds.

1,000,000+ curious minds.

一本书，多种聆听方式。

Measuring the Unmeasurable: The Surprising Science of Cybersecurity Risk

The Measurement Myth: Redefining What It Means to Measure

边听边看，每个词都清晰呈现

The Rapid Risk Audit: Your First Step Into Quantitative Security

The Analysis Placebo: Why Most Risk Assessment Methods Fail

从 《如何衡量万物》中收获更多

Calibrated Estimates: The Foundation of Better Forecasting

Bayesian Methods: Making the Most of Limited Data

边听边看，每个词都清晰呈现

Decomposing the Seemingly Unmeasurable

Toward Security Metrics Maturity: Building an Enterprise Approach

从 《如何衡量万物》中收获更多

A Call to Action: Redefining Cybersecurity Around Risk

你已读完 《如何衡量万物》

用户还喜欢

该学习计划的一部分

Learn Philanthropic Cost-Benefit Analysis

发现更多

《如何衡量万物》概述

从《如何衡量万物》中收获更多

从《如何衡量万物》中收获更多

你已读完《如何衡量万物》

从《如何衡量万物》中收获更多

从《如何衡量万物》中收获更多

你已读完《如何衡量万物》