premise: Keeping summary records of actual security incidents is one way that an organization can measure the frequency of various types of violations as well as the damage suffered from these incidents.
hypothesis: An organization never has the ability to measure the frequency of various types of violations.