Skip to content
sec/atlas
back to the map
practice
stage: prove
2 min read

Security metrics and reporting to leadership

A number that cannot change a decision is decoration. Good security metrics show whether risk is going down, how fast the team responds, and where leadership must act.

dashboards (Grafana, Looker)risk registerKRIs and KPIsvulnerability management dataincident timelinesboard reporting templates

Activity versus outcome

  • Activity metrics count work (scans run, trainings completed, tickets closed). They show effort, not safety.
  • Outcome metrics show results (time to remediate critical issues, share of assets covered by logging, time to detect and contain incidents).
  • KPIs describe how well a process performs; KRIs (key risk indicators) warn that risk is rising (growing backlog of critical findings, rising exposure of unsupported systems).
  • Prefer a few metrics tied to decisions over a long list nobody reads.

Useful measures

  • Detection and response: mean time to detect, to contain and to recover, by severity.
  • Vulnerability management: time to fix critical and exploited vulnerabilities; share of internet-facing assets in the inventory; age of the oldest critical finding.
  • Coverage: percentage of assets with endpoint protection, logging, backups tested, multi-factor authentication.
  • Resilience: restore tests passed, tabletop exercises run and actions closed.
  • Third parties: share of critical vendors assessed in the last year.
  • Risk: number and trend of risks above appetite, and how many have a funded plan.
metrics-definition.ymlyaml
- name: critical_vuln_time_to_remediate
  definition: "days from detection to verified fix, for critical findings on internet-facing assets"
  source: vulnerability-scanner + ticketing
  target: "<= 7 days, 90th percentile"
  owner: head-of-appsec
  review: monthly
  decision_it_informs: "whether to add engineering capacity to the remediation backlog"

Reporting to executives and the board

  • Lead with the answer: are we getting safer, and what do you need from us?
  • Translate to business terms: money, customers, regulatory exposure, downtime, not technical counts.
  • Show trends and targets, not isolated numbers, and explain changes honestly, including bad news.
  • Tie asks to decisions: a budget, a policy, an owner for a risk acceptance.
  • Keep it brief (one page and a few slides) and consistent, so changes are visible quarter to quarter.
  • Report incidents and near misses with what was learned and fixed.

Pitfalls

  • Gaming: when a metric becomes a target for individuals, people optimize the number, not the risk.
  • Vanity numbers: blocked attacks and scans completed say little about safety.
  • False precision: a risk score of 7.3 is not more accurate than "high".
  • Changing definitions silently: trends become meaningless; version your metric definitions.

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Study before

Unlocks

test what you learned

Loading questions…