Boards Need Risk Signals, Not Cyber Metrics

Boards of directors are increasingly aware of the importance of cybersecurity, but the way security teams report on their efforts is not providing the insights they need to make informed decisions about risk. According to experts, the current focus on metrics such as the number of blocked attacks, phishing clicks, and vulnerabilities discovered is not helping boards govern risk effectively.

"The problem is that most security metrics are really just activity metrics," says Richard Bejtlich, strategist and author in residence at Corelight. "They measure what the security team is doing, but they don't necessarily measure the effectiveness of those activities in reducing risk."

Bejtlich argues that what boards really need are risk signals, not metrics. "Time is really the universal metric because everyone can understand time," he says. "How fast do we detect problems, and how fast do we respond to them? Those are the kinds of metrics that can help boards understand whether risk is increasing or decreasing."

The issue is that security teams have become adept at measuring activity with increasing precision over the past decade, but this has not necessarily translated into better risk governance. "We've gotten very good at measuring the things that are easy to measure, but we haven't gotten very good at measuring the things that are hard to measure," Bejtlich says.

One of the challenges is that risk is a complex and multifaceted concept that cannot be reduced to a single metric or set of metrics. "Risk is about exposure, trajectory, and consequence," Bejtlich explains. "It's about understanding what could happen, how likely it is to happen, and what the impact would be if it did happen."

To provide boards with the insights they need, security teams need to move beyond activity metrics and focus on providing risk signals that can help inform decision-making. This requires a different approach to metrics and reporting, one that prioritizes clarity and simplicity over complexity and precision.

"Boards don't need to know about every vulnerability that's been discovered or every patch that's been applied," Bejtlich says. "They need to know whether risk is increasing or decreasing, and whether the controls that are in place are effective in reducing that risk."

Ultimately, the goal is to provide boards with a clear and concise picture of the organization's risk posture, one that can inform strategic decision-making and help ensure the long-term success of the organization. By moving beyond activity metrics and focusing on risk signals, security teams can play a more effective role in supporting this goal.

In order to achieve this, security teams need to work closely with boards and other stakeholders to understand their needs and priorities. This requires a collaborative approach to metrics and reporting, one that prioritizes communication and transparency over technical complexity.

"Security teams need to be able to explain risk in a way that's understandable to non-technical stakeholders," Bejtlich says. "They need to be able to provide a clear and concise picture of the organization's risk posture, and help boards understand what they need to do to reduce risk."

By taking a more collaborative and risk-focused approach to metrics and reporting, security teams can help boards make more informed decisions about risk and ensure the long-term success of the organization.