NFR requires that all the responses should have measurable equation which is used by tester in verification phase.
I thinking this is probably the root cause of your issue. Some problems are just hard, and can't easily be reduced to a simple metric.
If your business truly cares about protecting its users' PII, the best thing to do is almost certainly to ...
What you are struggling is called a chicken-egg problem in software requirement analysis phase. Clients don't share requirement detail because they don't know the detail architecture and architects cant make detail architecture because they don't know the detail of all requirements.
However there is a well known ...
As you've already surmised, a metric like "Attack Success Rate <= 0.001%" isn't a particularly useful test metric for an acceptance text.
Have a look at this page. It says:
Provider systems SHALL resist unauthorised, accidental or unintended usage and provide access only to legitimate users.
I don't think there is a clear answer to this. It depends on what your team needs and your solution. Let me explain:
Generally speaking in agile our goal is to provide end user value. There is a risk with API or other tech stories to create something that is of no value, or at least out of context. Imagine a story as in "I want API xzy to retrieve the ...