Using lessons from tested and proven disciplines like military kill-chain analysis, counterterrorism analysis, and industrial safety programs, the authors provide a methodology to help organizations analyze potential losses and determine appropriate countermeasures to implement to stop losses from accidental user mistakes and malicious actions, covering such topics as proactively planning to prevent and mitigate data breaches, optimizing security spending, and improving security culture.