7 Key Security Metrics for Organizational Security

Many security metrics can be tracked. The unique needs of your business will determine which ones to choose. Additionally, security teams are likely to have more specific metrics to track depending on their goals. Here are seven examples of some of the most commonly tracked metrics.

1. Mean time to detect (MTTD): The longer an intruder goes undetected, the longer they can operate within the network, gaining access to increasingly sensitive data or other business assets or initiating a privilege escalation attack. The mean time to detect is the average time between when a security incident occurs and when it’s detected. This metric helps detection and response teams assess the effectiveness of the organization’s incident management processes. 
2. Mean time to respond (MTTR): Detecting a threat is only part one of a cybersecurity incident; responding to it is the second. Mean time to respond measures the time required to resolve a threat and return the system to full operational condition. Measuring the time needed to remove a threat and regain control of the compromised system helps detection and response teams gauge the strength of the processes used to troubleshoot and resolve issues once they’ve been identified.
3. Unauthorized access attempts: Intrusion detection and response are integral to any business’s overall cybersecurity framework. Trackable security metrics include the number of unauthorized access attempts detected and blocked, where those attempts originated, and how quickly they were addressed. These metrics can help security teams fine-tune their processes for investigation and response, prevention of false positives, and how security data is correlated and analyzed.
4. Number of security incidents: Tracking how many security incidents have been detected and resolved within a certain period of time can capture trend data over time. Looking deeper to identify the number of each type of incident, their effect on the business, and how responses such as data recovery were managed reveals details that can help security teams improve detection and response processes.
5. Average cost per security incident: Responding to and resolving a breach is costly. Measuring the average cost per security incident should be as holistic as possible and include expenses such as the time required to investigate and resolve the incident, lost employee productivity, production losses and other related expenses. Quantifying the average cost per incident can result in more informed decisions about how security-related resources are allocated. 
6. Vendor security preparedness levels: Vendors with insufficient security controls can give intruders an access point into critical systems. A security incident with a vendor can quickly spread, so it’s essential to actively monitor your level of exposure to vendor-related risks. Tracking security metrics such as vendor security ratings, Security Operations Center (SOC) reports, and other security documentation can help teams better understand and quantify the level of risk each vendor presents.
7. Percentage of employees who complete security training: Employees represent a potentially significant security vulnerability. Responding to a phishing email can compromise an employee’s user credentials. A disgruntled employee with elevated permission can delete files or exfiltrate sensitive data. These are just two examples. By providing employees with instruction on how to recognize threats and respond, security compliance teams can better monitor employee training engagement to reduce exposure to these types of threats.