Key Takeaways: Security Metrics, Measurement, and Reporting to the Board

A one-page reference. Reread before an exam or before building a board deck. Dense by design.

The core vocabulary (memorize cold)

The test that separates metric from noise

If this number doubled or halved, what would anyone do differently? If the honest answer is "nothing," it is data exhaust — leave it out.

A good metric is: Actionable · Decision-tied · Comparable (trend/target/benchmark) · Hard to game · Cheaply & consistently collected.

The formulas (know them by hand)

$$\text{MTTD} = \frac{1}{n}\sum_{i=1}^{n}\left(t^{\text{detect}}_i - t^{\text{begin}}_i\right) \qquad \text{MTTR} = \frac{1}{n}\sum_{i=1}^{n}\left(t^{\text{resolve}}_i - t^{\text{detect}}_i\right)$$

$$\text{Coverage} = \frac{\text{protected in-scope items}}{\text{total in-scope items}}\times 100\%$$

• MTTD: anchor "begin" to the attacker's true first action (reconstructed via forensics), not first alert — or you understate dwell time. MTTD + MTTR = attacker's total window of opportunity.
• MTTR: define the "R" precisely (usually to containment); guard against gaming (premature ticket closure) by pairing with a reopen rate.
• Report the median beside the mean when one outlier distorts it; the outlier is usually the real improvement target.
• Coverage: the denominator is everything. Only as honest as the asset inventory beneath it; unknown assets are excluded and are where risk hides. Sharper form: detection coverage vs. MITRE ATT&CK.

Operational vs. executive metrics

Executive metrics aggregate/abstract operational ones; the summary must stay defensible by drilling down. Pitch every number at the altitude its audience governs from.

Maturity levels (five-level scale)

Related models: NIST CSF Tiers (Partial / Risk Informed / Repeatable / Adaptive), C2M2, CMMI. Maturity persuades boards: one number per domain · shows trajectory · structures the budget ask. Guard against grade inflation and false precision — tie scores to evidence; report "about 2.5," not "2.47."

The board conversation — four questions a pack must answer

Rules of the room: lead with the answer · tell the truth incl. bad news · translate to risk & money · 5–7 numbers not 50 · pre-load the drill-downs. A board buys risk reduction, not security.

Vanity vs. meaningful — quick discriminator

Certification crosswalk

Project additions this chapter

• Meridian program: metrics & board-reporting pack — one-screen executive scorecard answering the four board questions; rule = "5–7 load-bearing metrics, each defensible three layers down, rest in appendix."
• bluekit toolkit: metrics.py — mttd(incidents), mttr(incidents), coverage(protected, in_scope) (refuses a missing denominator).

Common pitfalls

• Measuring what's easy (activity) instead of what matters (outcome/risk).
• Reporting a bare mean when an outlier distorts it (hide the median, hide the real risk).
• Coverage metrics with a dishonest or unknown denominator (the unmanaged asset is where the breach is).
• Setting one metric (e.g., MTTR) as a target in isolation → gaming (Goodhart's law).
• Maturity grade inflation and false-precision decimals.
• An all-green board deck — it destroys credibility and signals blindness, not safety.
• Leading with the biggest number instead of the answer; speaking packets/CVEs instead of risk and money.