Has the state of cybersecurity improved, declined, or stayed the same? To answer, we need a reliable way to measure “the state of cybersecurity” and assess how it has changed over time. Some current measures include counts of vulnerability (e.g., CVE) reports and/or exploitations (as done by MITRE and Google Project Zero), counts of data breaches (as done by Verizon), and operational costs and revenue losses to companies due to cyber incidents (as estimated by affected companies). In this talk, I propose another measure: harms experienced by end users. End-user harms relate to business-centered measures like those above, but provide essential context about their severity. As an analogy, the Bureau of Labor Statistics surveys both employers and employees because these sources may tell different stories; business and end-user reports about cybersecurity harms may do likewise. A key challenge is how to collect the data. Surveys, device monitors (such as part of security software deployments), and local population studies may be options.