# Security Metrics and Reporting
Security metrics are quantitative measurements that track the effectiveness, efficiency, and maturity of an organization's security program. Security reporting translates those metrics into decision-relevant information for different audiences: operational teams, executive leadership, and the board of directors.
Most security programs produce the wrong metrics. Alert volume, ticket count, and tools deployed measure activity, not effectiveness. An SOC that processes 10,000 alerts per week is busy. Whether it is effective depends on how many real threats it detected, how quickly it responded, and whether the detection coverage improved over time. Activity metrics tell the board the security team is working. Effectiveness metrics tell the board the security program is working.
The distinction matters operationally and strategically. A board presented with "we processed 42,000 alerts this quarter" has no basis for evaluating security posture. A board presented with "we detect 62% of MITRE ATT&CK techniques relevant to our threat profile (up from 48% last quarter), our mean time to contain incidents is 3.8 hours (down from 6.1), and our critical vulnerability remediation rate is 94% within SLA" can evaluate whether the security investment is producing measurable improvement.
Security metrics fall into four categories:
Operational metrics measure the performance of security operations on a daily/weekly basis. These are consumed by the security team and operations management:
Mean time to detect (MTTD): average time from attacker's first activity to SOC detection. Mean time to respond/contain (MTTR): average time from detection to containment. Alert volume and true positive rate: total alerts and the percentage that are genuine incidents. Patch compliance rate: percentage of systems patched within SLA by severity tier. Phishing simulation click rate and report rate. Vulnerability remediation velocity: rate of closure versus rate of discovery. DLP incidents by type and severity. MFA coverage: percentage of users and systems with MFA enforced.
Operational metrics drive daily decisions: which detection rules need tuning, which systems need patching, which users need additional phishing training.
Tactical metrics measure program progress over weeks/months. These are consumed by security leadership and the CISO:
Detection coverage: percentage of MITRE ATT&CK techniques covered by detection rules, tracked quarterly. Remediation SLA compliance by severity tier. Risk register trending: are the top risks improving, stable, or deteriorating? Compliance readiness status by framework. Incident count and severity trending. Security training completion and effectiveness trending. Vendor risk assessment completion rate.
Tactical metrics drive resource allocation: which domains need more investment, which programs are on track, which are falling behind.
Strategic metrics measure program effectiveness over quarters/years. These are consumed by executive leadership and the board:
Overall Posture Score (composite and per-domain). Annualized loss expectancy (ALE) trend for top risks. Security investment as a percentage of revenue or IT spend (benchmarked against industry). Year-over-year improvement in key indicators (detection coverage, MTTR, patch compliance). Compliance certification status and audit findings trend. Incident impact trending (financial cost, operational disruption, data exposure).
Strategic metrics drive investment decisions: should the security budget increase, where should it be allocated, and what return is it producing?
Outcome metrics measure real-world results:
Number and severity of confirmed breaches. Financial impact of security incidents. Regulatory findings and fines. Cyber insurance claims and premium trends. Customer-facing security incidents. Successful vs. unsuccessful attacks (the ratio indicates whether the defense is working).
Outcome metrics are the ultimate test of security effectiveness, but they have a statistical limitation: a year with zero breaches could mean the security program is excellent, or it could mean the organization was not targeted. Outcome metrics must be interpreted alongside process metrics (operational, tactical, strategic) that measure the program's capability independent of whether it was tested by an attacker.
Different audiences need different views of the same underlying data:
Security team (weekly). Operational dashboards showing current alert queue, open incidents, detection rule health, patch compliance status, and SIEM data source connectivity. The security team needs real-time operational data that drives daily actions.
CISO (monthly). Tactical report showing program progress against the security roadmap, key metric trends, risk register updates, incident summaries, and resource utilization. The CISO needs trending data that reveals whether the program is improving and where gaps persist.
Executive leadership (quarterly). Strategic report showing Posture Score trending, risk posture changes, major incidents and their business impact, compliance status, and investment effectiveness. Executive leadership needs decision-relevant information tied to business outcomes.
Board of directors (quarterly or semi-annually). Board-level report showing the answers to three questions: What is our risk? What are we doing about it? Is it working? The board report should fit on one to two pages. Detailed metrics are available in appendices for board members who want depth, but the primary report must be consumable in 5 to 10 minutes.
Vanity metrics. Metrics that look impressive but do not indicate effectiveness. "We blocked 2.3 million attacks this month" sounds impressive but says nothing about the attacks that were not blocked. "We have 47 security tools deployed" says nothing about whether they are configured correctly, monitored actively, or producing value.
Activity metrics without context. "The SOC processed 15,000 alerts" without stating the true positive rate, the average investigation depth, or the detection coverage percentage. Activity does not equal effectiveness. A SOC drowning in false positives is busy but not effective.
Lagging-only reporting. Metrics that only report what has already happened (incidents, breaches, audit findings) without leading indicators (detection coverage improvement, patch compliance trending, training effectiveness). Lagging metrics tell the board what went wrong. Leading metrics tell the board whether the organization is getting better at preventing future incidents.
Metric overload. Presenting 40 metrics to the board. No audience can process 40 data points in a quarterly briefing. The board needs 5 to 8 key metrics with trend indicators. The CISO needs 15 to 20. The security team needs the full operational dashboard. Each audience gets a filtered view of the same underlying data.
Inconsistent measurement. Changing how metrics are calculated between reporting periods makes trending impossible. If MTTR was measured from detection to containment last quarter but from detection to eradication this quarter, the numbers are not comparable. Metric definitions must be documented and consistent.
CDA's Posture Score provides a unified measurement framework built on the six PDM domains. Each domain receives a score (0 to 100) based on weighted control effectiveness metrics:
| Domain | Key Metrics Feeding the Score | |--------|------------------------------| | DPS | Encryption coverage, backup test results, DLP policy coverage, data classification completion | | VSD | Vulnerability density trending, patch compliance by severity, attack surface size trending, application security scan coverage | | SPH | EDR coverage, configuration compliance, phishing click rate, endpoint hardening score | | IAT | MFA coverage, PAM enrollment, access certification completion, deprovisioning SLA compliance | | TID | Detection coverage (ATT&CK %), MTTD, MTTR, log source connectivity | | RGA | Compliance readiness score, risk register currency, audit finding remediation rate, policy review currency |
The composite Posture Score is the weighted average of the six domain scores. Weights are adjustable based on the organization's risk profile (a healthcare organization may weight DPS higher because PHI protection is paramount; a defense contractor may weight RGA higher because compliance is a contract requirement).
The Posture Score is visualized on The Shield: CDA's PDM visualization showing six concentric rings (one per domain) divided into six segments. Each segment is color-coded: green (score 80+), amber (50-79), red (below 50). The Shield provides a 30-second executive summary that answers "where are we strong and where are we weak" without reading a single number.
The Posture Score trending is the strategic metric that board reporting is built around. A board that sees the composite score moving from 42 to 67 over 12 months knows the security investment is producing measurable improvement. A board that sees the score plateauing at 55 knows the program has stalled and needs intervention. The number enables the conversation that heat maps and alert counts cannot.
Security budgets compete with every other organizational priority. Metrics that demonstrate measurable risk reduction justify continued and increased investment. A CISO who presents "we reduced MTTD from 72 hours to 4 hours, which means attackers have 68 fewer hours to operate before we detect them, reducing the expected impact per incident by 60%" makes a case the CFO can evaluate.
Without metrics, the CISO's budget request is "we need more money for security." With metrics, it becomes "this specific investment produces this specific risk reduction measured by these specific indicators." The second conversation is winnable. The first is not.
SEC cybersecurity disclosure rules require public companies to describe their cybersecurity risk management processes. SOC 2 CC4 (Monitoring Activities) requires the organization to monitor key metrics. ISO 27001 Clause 9 (Performance Evaluation) requires the organization to measure ISMS effectiveness. NIST CSF 2.0 includes measurement and assessment across all functions. Auditors and regulators expect documented metrics with trending data.
Metrics drive the improvement cycle. A phishing click rate that increases from 4% to 8% identifies a training gap that needs intervention. A MTTR that increases from 3 hours to 6 hours identifies a process bottleneck in the incident response workflow. A detection coverage percentage that plateaus at 45% identifies a detection engineering program that has stalled. Without metrics, degradation goes unnoticed until an incident reveals it.
Security metrics sit in the RGA (Risk Governance and Assurance) domain of the Planetary Defense Model. RGA is the strategic envelope: the governance layer that ensures the organization can measure, communicate, and improve its security posture over time.
CDA's Perpetual Compliance Assurance (PCA) methodology integrates metrics into continuous operations rather than periodic reporting. "Compliance is not an event. It is a state." Metrics are not collected quarterly for the board report. They are collected continuously and available in real time through the Posture Score dashboard. The board report is a snapshot of a continuous data stream, not a special project.
RGA-C01 (Security Reporting Program, 8 estimated hours per cycle) establishes and sustains the reporting framework: metric definitions, data sources, collection automation, dashboard configuration, and audience-specific report templates. The mission is lightweight per cycle because the infrastructure (once built) operates continuously.
CDA approaches security metrics with one principle: every metric must drive a decision or track a trend that drives a decision. A metric that is reported but never acted on is noise. A metric that reveals a degradation and triggers a specific remediation is signal. CDA's Posture Score model ensures every metric connects to a domain score, every domain score connects to the composite score, and the composite score connects to the board conversation. Nothing is measured that is not acted on.
Word count: 1,946