Many security reports are full of impressive numbers that tell leaders nothing: millions of “threats blocked,” thousands of emails filtered. The metrics that matter show whether your biggest risks are going up or down — and whether the basics are really in place.
Metrics that tell you something
- Multi-factor authentication coverage: the percentage of accounts — especially administrator and remote-access accounts — protected by it. The target is 100%.
- Patching speed: how many days it takes to fix critical vulnerabilities, particularly on internet-facing systems.
- Backup recovery tests: when you last restored critical systems from backup, whether it worked, and how long it took compared with your target.
- Time to detect and contain: how long it takes to notice a security incident, and how long to stop it spreading. Shorter is better, and the trend matters more than any single number.
- Open high-risk findings: how many serious issues from your last assessment or penetration test are still unresolved, and for how long.
- Phishing reporting rate: the share of staff who report simulated phishing emails. Reporting matters more than click rates, because reports let you respond.
- Vendor coverage: the share of vendors with access to your systems that have been reviewed.
Metrics to treat with caution
- “Attacks blocked”: big numbers that mostly measure internet background noise.
- Training completion alone: it shows attendance, not behaviour.
- Tool counts: more products doesn't mean more security.
How to present them
- Show trends over time, not just this month's number.
- Pair every metric with a target and a named owner.
- Highlight the two or three things that need a decision from the board.
Questions the board should ask
- Which of these metrics is moving in the wrong direction, and why?
- What would it take to reach our targets, and by when?
- What are we accepting as risk, and has that been decided deliberately?
Key takeaways
- Measure the basics that prevent most attacks.
- Focus on trends, targets and owners.
- Good metrics lead to decisions, not just reassurance.