Metrics That Don't Lie: Five Numbers, Not Fifty

Most security dashboards report activity: emails blocked, alerts processed, training modules completed. Those numbers go up whether you are getting safer or not. A good metric changes when risk changes, and it would make you uncomfortable if it went the wrong way.

Five numbers worth having

Your five will depend on your business, but they usually look something like this:

• How fast we fix what matters. Time to fix critical weaknesses on internet-facing systems, measured from when you knew.
• How much of the estate we can see. Share of important systems sending logs you actually review.
• How well the keys are guarded. Share of admin and remote access protected by strong sign-in.
• Whether we can recover. Date of the last full restore test for your most important system, and whether it worked.
• How fast we notice. Time from first sign of an intrusion to someone acting on it, from real incidents and exercises.

How numbers lie

• Averages hide the worst case. One unpatched server facing the internet matters more than a good average.
• Coverage counts the easy systems. Ask what is missing from the count.
• A number that only goes up is decoration. If nothing could make it go down, it is not measuring risk.
• People optimise what you measure. If you reward closed tickets, you get closed tickets.

Make each one useful

For every metric, write down what it means, where the data comes from, what good looks like and what you will do if it goes the wrong way. If you cannot fill in the last part, it is not a metric you need.

Show each number as a trend over several months, not a single snapshot. One reading tells you very little. A line moving the wrong way for three months tells you a lot, and it gives you a reason to ask for help before something breaks rather than after.

Rule of thumb:Rule of thumb: if a number cannot change a decision, stop reporting it.