'Evidence-based cybersecurity policy? A meta-review of security control effectiveness' <- In case you missed, this is worth reading.

tandfonline.com/doi/full/10.10…