Efficacy is how well a security control or technique works under real operating conditions, not just in a test lab. In cyber security, a tool can look strong on paper but still fail against noisy networks, user behavior, or active attacker adaptation. Measuring efficacy helps answer the practical question: does this control actually reduce risk?
This matters for defenses such as MFA, EDR, phishing filters, and encryption settings. A control with high efficacy blocks or detects attacks consistently, while low efficacy leaves gaps attackers can exploit through password spraying, social engineering, or evasion tactics. Security teams measure efficacy with detection rates, false negatives, attack simulations, and red-team testing, then compare results against a known benchmark. The goal is not novelty; it is dependable performance in the conditions where attacks really happen.