Security Metrics That Actually Work (And Why Most Suck)

Historical Archive Note: This post was originally published on the Gartner Blog Network on June 22, 2008 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2014/08/18/security-metrics-that-actually-work/ | Archive.org Snapshot

Security dashboards are crowded with meaningless vanity metrics: "We blocked 14,000,000 firewall probes this week" or "We ran 45 antivirus scans." None of these communicate whether the business is safer today than yesterday.

Metrics that actually drive operational security must measure coverage, latency, and remediation efficiency: Mean Time to Triage high-severity alerts, percentage of critical assets with verified telemetry, and time required to isolate compromised credentials.