Top 10 Cybersecurity Metrics and KPIs
 

Identifying human risk and establishing more resilient defenses have become essential in any organization's daily operations. Yet, the path to protection is often bumpy. While there’s no universal consensus on which techniques an enterprise should use to track progress, organizations that identify relevant metrics and KPIs are far more likely to build a better human risk management program than those that do not.

What’s needed is visibility into the things that matter most to specific groups along with technology that supports the metrics and KPI framework organizations need. Unfortunately, when it comes to providing visibility into human risk and cybersecurity operations, many vendors fall short, leaving their customers needing a better solution.

Visibility Fuels a Successful Human Risk Management Program

A starting point for establishing improved human risk management is to recognize that cybersecurity metrics and KPIs are crucial because they provide the insight needed to identify human risk within an organization. However, the terms cybersecurity metrics and KPIs are often used synonymously — though they actually mean different things. The former represents tactical and often day-to-day measurement of results while the latter revolves around strategic and general measures of success.

In practical terms, KPIs are best used to drive strategic decision-making, particularly in regard to long-term objectives. These criteria are most valuable for CIOs, CSOs, CISOs, and others who guide budgets and the overall strategic direction of an organization. They focus on what’s working, what’s not working, and where improvements are possible.

However, it’s impossible to put effective KPIs in place without metrics to support them — and essentially feed in the data that’s required. Metrics deliver the quantitative data that demonstrates whether a tool, program, or initiative is performing well. At times, it may be necessary to change metrics, and it’s important to use appropriate metrics for each group or department.

Metrics and KPIs Promote Human Risk Management

For example, IT and security groups might measure criteria such as unidentified devices on internal networks, intrusion attempts versus the actual number of security incidents, and incident response data. All of these measurements are necessary to determine if human risk management and cybersecurity operations efforts are effective. Team members, meanwhile, can be held accountable for how often they click on bad links or violate regulatory controls such as data privacy protections. Identifying human risk factors and the team members that pose the biggest threat can lead to proper training which will help avoid future incidents. 

Likewise, a board of directors and senior executives are likely to examine metrics surrounding human risk, training efficacy, cyber resilience, and cyber exposure. Meanwhile, a finance group would likely focus on factors such as risk reduction costs per unit, loss-to-value ratios, and control costs per IT asset.

It’s important to recognize that not all risks are equal, just as the risk posed by each individual user is not equal. Research indicates that 80 percent of all security issues are caused by just eight percent of users. It's just as important to recognize that no tool, technology, framework, or procedure can deliver a 100% guarantee that an organization will remain secure. Metrics must match the acceptable risk exposure level for a device, system, or department and its users — and an organization must have a way to constantly gauge incidents, risks, and the liabilities each user poses in this context.

Yet, with metrics in place, business leaders and security teams can make more informed decisions — particularly regarding the overall effectiveness of a human risk management program and what it costs. They also are in a better position to understand specific tools and technology, and which solutions deliver maximum benefits. Along with a dashboard that delivers critical security data, there must be mechanism in place for transforming this technical data into strategic information that business analysts and the C-suite can use, as well as security teams attempting to identify human risk factors. 

Identify the Metrics that Really Matter

Several high-level metrics and KPIs are commonly used to improve human risk management and cybersecurity operations. Among those that matter the most:

1. Intrusion attempts vs. actual security incidents. This metric offers general insight into existing vulnerabilities, the state of preparedness, and how the organization responds to attacks.
2. Mean time to detect (MTTD). This is a crucial element because the faster an organization identifies an attack, the greater the odds it can contain it with minimal damage.
3. Mean time to respond (MTTR). The ability to neutralize a threat and get systems back online is critical because as events drag out, risks and costs increase.
4. Mean time to contain (MTTC). This metric refers to the average time required to shut down all attack vectors across all endpoints and minimize the probability of any further damage.
5. Unidentified devices on the network. An ability to discover and tag unidentified devices greatly reduces the odds that someone has unauthorized access to the network.
6. Patching cadence and effectiveness. It’s vital to ensure that software patches are applied quickly and effectively. However, it’s also important to know which patches should be prioritized.
7. Human risk management training effectiveness. Ensuring that employees understand how to respond to attacks is essential. Human error is a leading cause of intrusions and breakdowns. For instance, phishing test success rates and dynamic risk scoring — part of Mimecast's Human Risk Management Platform — offer insights into how a human risk management training program is performing.
8. Peer and industry benchmark data. With independent data, it’s possible to know how an organization is performing compared to others in the industry. However, it’s also important to understand whether industry benchmarks are adequate so that an organization doesn’t regress to the mean.
9. Security audit compliance. This metric delivers actionable information about whether tools, technologies, and procedures are working — and where they’re falling down.
10. Third-party risk and compliance. Extended supply chains, third-party vendor apps, and APIs all represent risk. As a result, it’s vital to understand risks in the context of third-party privileges and relationships.

The Bottom Line

Improving human risk management and cybersecurity operations requires focus, vigilance, the right technology, and proven training methods. Identifying useful metrics and achieving adequate visibility to apply them across all of an organization’s IT and security assets, as well as across all users, can be challenging. But organizations that understand which metrics really matter for specific groups — as well as the KPIs that drive performance overall — are equipped to reduce risk and avoid potentially crippling attacks. Read more about how Mimecast's Human Risk Management Platform can support your performance measurement.

**This blog was originally published on October 27, 2022.