“Are we secure?” is an impossible question to answer with a yes or no. A better one is “are we getting safer, and where are we still exposed?” Cybersecurity metrics help you answer that with evidence instead of impressions. The aim is not a dashboard crowded with numbers, but a short list that shows progress and prompts decisions.
Principles for choosing metrics
- Tie each metric to a risk or control. If nobody would act on it, drop it.
- Prefer a few good measures over many. Eight to twelve is plenty.
- Show trends. A single value means little. Movement over months is informative.
- Use plain language. A board or owner should understand it in minutes.
Metrics for prevention
Multi-factor authentication coverage
The percentage of users, and of administrators, protected by multi-factor authentication. The target is 100 percent, and the administrator figure should reach it first.
Patching cadence
How quickly critical updates are applied, and the percentage of devices fully up to date. Long delays between a patch release and installation leave known flaws open.
Device coverage
The share of devices that are managed, encrypted and running endpoint protection. Unmanaged devices are blind spots.
Open vulnerabilities
The number of high and critical findings from regular scanning, and how that changes. A routine vulnerability assessment produces the data, and the trend tells you whether you are keeping up.
Alignment to a framework
Your progress against a standard such as the CIS controls, expressed as the percentage of safeguards implemented. It gives you a clear roadmap and a way to show improvement.
Metrics for detection and response
Mean time to detect
How long a threat is present before someone notices. Round the clock monitoring, such as managed detection and response, shortens it.
Mean time to respond and contain
How long from detection to containment. The faster you contain an incident, the smaller the damage.
Incidents by type
Phishing attempts, blocked malware, suspicious sign ins and confirmed incidents, trended month to month. Rising reports from staff can be a good sign, because it means people are noticing.
Metrics for people
Training completion and phishing results
The percentage of staff who completed security awareness training, and how many click or report in simulated phishing exercises. Improvement over time is the goal, not catching people out.
Time to remove access
How quickly accounts are disabled after someone leaves. It should be the same day.
Metrics for resilience
Backup success and restore tests
The percentage of jobs that succeed, and the date and result of your last test restore. A backup without a tested restore is an assumption.
Recovery time against target
When you test a recovery, how long it takes compared with your objective. See our disaster recovery plan guide for setting targets.
| Area | Example metric | Healthy direction |
|---|---|---|
| Prevention | MFA coverage, patch compliance | Toward 100 percent |
| Detection | Time to detect | Down |
| Response | Time to contain | Down |
| People | Training completion, phishing reports | Up |
| Resilience | Successful restore tests | Regular and passing |
Reporting to leadership
Keep it to one page: a short summary, the top metrics with trends, the biggest risks, and the decisions you need. Compare against last quarter, not an abstract ideal. Our cybersecurity assessment establishes a baseline, and a managed provider can produce the reporting each month.
Watch for misleading metrics
- Counting blocked attacks. A big number of blocked emails sounds impressive but says little about risk.
- Averages that hide outliers. One neglected server can sit behind a good average.
- Chasing the score. If improving a number becomes the goal, behaviour can drift from real security.
We provide plain language monthly reporting that shows progress and next steps.
Talk to our security teamFrequently asked questions
How many metrics should we track?
A dozen or fewer, organized by prevention, detection, people and resilience.
How often should we report?
Monthly to management, and quarterly with a trend summary to owners or the board.
Where do metrics come from?
Your identity platform, endpoint tools, scanners, backup reports and training records.
Related service: Cyber Security Assessment
Last updated
