Many security teams lean on a certain set of cybersecurity metrics when they’re reporting to higher-ups—these metrics, like number of intrusion attempts or number of alerts per day, are easy to find, so security teams can quickly deliver them and get back to their work.

Unfortunately, these “default” metrics communicate a very small part of the security health of the organization, and they’re often meaningless in communicating cybersecurity risk at the board level. As a result, the company misses the big picture and can’t make data-backed security decisions.

In this blog, we’ll go over the three key security metrics to convey the true state of security in a way that’s clear to the security team and board members alike.

Key Security Metric #1: Visibility

Organizations can’t be efficient with incident response without the proper level of visibility over their environment. Organizations need comprehensive visibility into 100% of what’s going on in their systems, regardless of whether they are on-premises or in the cloud. This critical metric tells them where they lack coverage from a data perspective and is directly tied to the level of detection that can be performed.

To get a good sense of your visibility level, answer the following questions:

  • Do you have the right level of visibility into threats and your environment?
  • How much of your environment can you see?
  • Are you missing detection coverage?

Key Security Metric #2: Detection Coverage

While log source coverage is important for visibility, detection coverage helps you gauge how well you are protected against industry standard stages of an attack cycle.

By mapping against industry frameworks like MITRE ATT&CK® or the Kill Chain, you can determine whether you have the controls you need to get critical visibility into the types of threats that are of concern to the business. From there, you can map your use cases across your major detection controls (SIEM, EDR, UEBA) to these industry frameworks to understand the types of attack techniques into which you have visibility. You can see progress against your program goals and identify gaps in real-time and focus your efforts to decrease risk.

Additionally, you can ensure that your security program aligns with the organization’s evolving business requirements by identifying specific cyber risk scenarios, such as phishing or ransomware, and measuring coverage against them. This process allows for a more comprehensive understanding of the organization’s overall security posture.

To help you measure detection coverage, ask yourself these questions:

  • Do we understand known threats, attacks, and IOCs?
  • How quickly can we deploy coverage?
  • How well are existing tools functioning?
  • Do you have the controls in place for visibility into critical threats?
  • How well do you understand your cyber risk?
  • Can you detect the risk scenarios that matter to you?

Key Security Metric #3: Mean Time to Resolve (MTTR)

You can use mean time to resolve (MTTR) in conjunction with other metrics to gain insight into the effectiveness of the incident response process and inform decisions about team performance. By evaluating MTTR, along with other metrics, you can determine if the process has been optimized, if staffing levels are adequate, if training is needed, or if the issue lies with getting buy-in from the business.

Answering the following questions can help you get a good sense of how your team is performing:

  • Where is your team spending its time?
  • How proactive is your team in countering threats?

Key Takeaways

Instead of relying on “default” metrics, you are better served by focusing on metrics that provide a more comprehensive understanding of the organization’s security posture. By evaluating the key metrics above, organizations can make data-backed security decisions, identify gaps in coverage, and understand the effectiveness of their incident response processes. Analyzing and communicating metrics around Visibility, Detection Coverage, and MTTR allow you to improve your security health and communicate upwards and across your organization more effectively.