Security: KPIs
Detection, response and exposure measures, including dwell time, false-positive rate, and why counting blocked attacks is a vanity metric.
Markdown. No sign-up, no email.
Security metrics fail in a specific way: the comfortable ones are easy to grow and say nothing. Attacks blocked, alerts generated and tools deployed all rise without the company being safer.
These measure exposure, speed and whether the signal is trusted.
The six that matter#
| Measure | Definition | Target | How it gets gamed |
|---|---|---|---|
| Dwell time | Compromise to detection | Under 24 hours | Only counting incidents that were detected, which excludes the worst ones by construction |
| Time to contain | Detection to contained | Under 4 hours | Calling partial containment done |
| False-positive rate | Alerts that were nothing | Under 20% | Tuning by suppression rather than by improving the signal |
| Critical vulnerability age | Days a critical stays open on an exposed system | Under 7 | Reclassifying critical as high |
| Coverage | Share of assets actually reporting telemetry | Above 98% | Counting assets we know about. The unmonitored asset is the one that gets used |
| Approval latency | Score to human decision on a high-risk event | Under 15 min | Auto-approving to hit the number, which removes the gate entirely |
Approval latency is the honest test of the human gate. A gate nobody can reach at 3am is a gate that will be removed within the quarter, and it will be removed for good practical reasons. The way to keep it is to make it fast, not optional.
Coverage is the number most likely to be quietly wrong. It is measured against the asset inventory, and the asset that hurts you is usually the one missing from it. Reconcile against billing and DNS, not against the inventory alone.
Two counter-metrics#
| Counter-metric | Catches |
|---|---|
| Alerts closed without investigation | A team overwhelmed and triaging by clicking. The precursor to every missed intrusion |
| Exceptions granted and still open | Temporary risk acceptances that became permanent. Every one has a date and most are past it |
Exposure review, monthly#
| Question | Bad answer |
|---|---|
| What is internet-facing that does not need to be? | Anything discovered rather than known |
| Which credentials are older than 180 days? | Any, on a production system |
| Which accounts have privileges they have not used in 90 days? | Standing access nobody exercises is pure attack surface |
| Which cloud configurations drifted from baseline? | Drift nobody noticed |
What is deliberately not measured#
- Attacks blocked. Grows with internet background noise and correlates with nothing.
- Alert volume. More alerts is a cost, not a defence.
- Tools deployed. Spend, not posture.
- Training completion. Attendance, not behaviour. Measure phishing-report rate instead, which is behaviour.
Cadence#
| Continuous | Detection and scoring |
| Daily | High-risk events, approval latency, anything closed without investigation |
| Weekly | Vulnerability ageing, false-positive rate |
| Monthly | Exposure review, coverage reconciliation, open exceptions |
| Quarterly | Response allowlist, access review with Data and Analytics, tabletop exercise |
The quarterly tabletop is the only one that tests whether the plan works when people are tired and guessing. A plan that has never been rehearsed is a document, and during an incident it reads like one.