Security Metrics Library
A browsable library of 56 real security metrics and cybersecurity KPIs — the classics every programme reports (MTTD, MTTR, patch latency, critical-vuln SLA, MFA coverage, phishing click and report rates, backup and restore-test rates, control coverage vs framework) and a full AI-era section for teams now running models, agents and LLM features in production. Filter by category, audience and framework, then build a weighted risk-score dashboard and export it. It runs entirely in your browser.
What this library is, in plain words
Security metrics are quantified measures of how well a security programme is working. This library catalogs 56 of them across 8 categories — detection and response, vulnerability management, identity, awareness, resilience, governance, third-party risk, and AI security — of which 11 are AI-era metrics that did not exist before teams put models and agents into production.
Each metric gives a plain-English description, how it is computed, its unit and cadence, the audience it suits (board, CISO, SOC, engineering) and the frameworks it maps to (NIST CSF, ISO 27001, FAIR, MITRE ATT&CK, NIST AI RMF, OWASP LLM Top 10 and more).
There are no fabricated benchmark numbers anywhere here. Instead of a borrowed “industry average” that becomes a bad target, every metric tells you how to baseline and set your own target. The risk-score builder's composite and its bands are PlayCISO's own transparent rubric, computed only from the weights and self-ratings you enter. Browsing and the on-screen score are free; exporting the scorecard is the one Pro feature.
Mean Time to Detect · MTTD
The average elapsed time between a security incident beginning and your team becoming aware of it. It measures how quickly your detection stack and analysts notice that something is wrong.
Set your target
Baseline your current MTTD over at least one full quarter before committing to a number. Set the target as a percentage reduction on your own baseline (for example, cut it by a third over two quarters) rather than copying a figure from a report. Segment by incident type — commodity malware and a hands-on-keyboard intrusion are not the same clock.
Mean Time to Respond / Recover · MTTR
The average time from detection to the incident being fully resolved and normal operations restored. Pairs with MTTD to describe the full lifecycle of an incident.
Set your target
Define precisely what "resolved" means for you (contained vs fully remediated) before measuring, or the number will drift as definitions do. Target a reduction against your own baseline, and watch the distribution, not just the mean — a handful of slow incidents can dominate while most are fast.
Mean Time to Contain · MTTC
The average time from detection to containment — the point at which the incident can no longer spread or cause further damage, even if full recovery is still ongoing.
Set your target
Containment speed is where a response programme most directly limits blast radius, so set an aggressive but achievable target relative to your own measured baseline. Review your slowest containment cases individually — they usually reveal a missing playbook or an access bottleneck rather than a number to chase.
Security Incident Count
The number of confirmed security incidents over a period, usually broken down by severity. A volume metric that is only meaningful alongside trend and context, not as a bare figure.
Set your target
Do not set an arbitrary "fewer incidents" target — better detection can legitimately raise the count. Track the trend by severity and pair it with MTTD/MTTR, so you can tell improved visibility apart from a genuine rise in attacks. Agree internally what qualifies as an incident so the count stays comparable over time.
Cost per Incident
The total cost attributable to security incidents — response labour, downtime, recovery, legal and regulatory costs — expressed per incident or in aggregate. The metric that translates security into the board’s language.
Set your target
Build the cost model with finance so the figure is defensible, then track reduction against your own history. FAIR is the right lens for framing this in terms of loss event frequency and magnitude. Avoid quoting external "average breach cost" headlines as if they were your target — they are not your environment.
EDR / Endpoint Coverage
The proportion of in-scope endpoints and servers running a healthy, reporting endpoint detection and response agent. Coverage gaps are exactly where an intrusion hides.
Set your target
Define your asset denominator first — unknown assets are the real gap — then aim to close toward full coverage of what you can see while shrinking the unknown set. Count only agents that are actually reporting, not merely installed; a silent agent is zero coverage.
Detection Rule Efficacy
How well your detection content actually catches real threats — the share of true positives among what fires, and coverage of the techniques you care about. Keeps detection honest.
Set your target
Measure efficacy against known test cases (purple-team runs, attack simulations) rather than guessing. Target coverage of the ATT&CK techniques most relevant to your threat model, and treat a missed detection in testing as a prioritised backlog item, not a scoreboard number.
Alert False-Positive Rate
The proportion of alerts that turn out to be benign. High false positives burn analyst time and desensitise the team, so this is a health metric for the whole detection pipeline.
Set your target
There is no universal "right" rate — set a target that keeps analyst workload sustainable for your team size and tune noisy rules to get there. Track it per detection source so you can retire or fix the rules that generate the most noise rather than chasing a global figure.
SOC Alert Volume
The number of alerts reaching the SOC per period, often normalised per analyst. A capacity and tuning signal: rising volume with flat staffing is a leading indicator of missed alerts.
Set your target
Treat this as a capacity-planning and tuning metric, not a target to minimise blindly. Establish the volume one analyst can meaningfully triage in your context, then watch whether volume per analyst is trending toward or past that line and act on tuning or staffing before quality drops.
Alert Dwell / Triage Time
The time an alert waits in the queue before an analyst begins working it, and how long triage then takes. Long dwell times mean real threats sit unexamined.
Set your target
Set dwell-time targets by alert severity — critical alerts should have a tight, explicit SLA, lower severities a looser one. Baseline against your own queue, then shorten the critical-severity target first, since that is where delay costs the most.
MITRE ATT&CK Technique Coverage
The share of adversary techniques relevant to your threat model for which you have at least one validated detection or mitigation. A map of where you are blind.
Set your target
Scope to the techniques your likely adversaries actually use rather than the whole matrix — full coverage of everything is neither realistic nor useful. Prioritise techniques seen in incidents against your sector, and validate detections by testing, so "covered" means proven, not assumed.
Alert Escalation Rate
The proportion of triaged alerts that are escalated to a full incident investigation. Read together with false-positive rate, it describes how your funnel narrows from noise to real work.
Set your target
This is diagnostic rather than a target to hit. A very low rate can mean good upstream filtering or missed threats; a high rate can mean good fidelity or an over-cautious team. Interpret it alongside true-positive outcomes and set expectations per alert source.
Patch Latency
The time between a patch being available and it being deployed across your estate, usually tracked by severity. The window during which a known, fixable flaw remains exploitable in your environment.
Set your target
Set latency targets per severity (tight for critical, looser for low) tied to your own remediation SLAs rather than an external figure. Baseline current latency, then tighten the critical-severity target first. Measure from availability, not from when a ticket happened to be opened.
Critical Vulns Remediated Within SLA
The percentage of critical (and high) vulnerabilities fixed inside the service-level agreement you have set for that severity. The headline accountability metric for a vulnerability programme.
Set your target
First set a defensible SLA per severity for your risk appetite, then target a high and improving adherence rate against it. Push toward full adherence for critical severity over time; use the breaches to find the systemic blocker (change windows, ownership gaps) rather than treating each as a one-off.
Vulnerability Recurrence Rate
The share of vulnerabilities that reappear after being marked fixed — through re-imaging, drift, or a fix that did not hold. A quality signal for remediation, not just speed.
Set your target
Aim this toward zero over time, since recurrence usually means a root cause (a golden image, a pipeline default) was not addressed. Baseline the rate, then investigate the top recurring findings — fixing the source, not the symptom, is what moves this number.
Asset Scan Coverage
The proportion of known assets that are actually being scanned for vulnerabilities. Unscanned assets are unmeasured risk, so this bounds the credibility of every other vuln metric.
Set your target
Reconcile against an authoritative asset inventory, not the scanner’s own view, or you will measure coverage of a convenient subset. Target near-complete coverage of inventoried assets while separately driving down the count of assets that are not inventoried at all.
Open Critical Vulnerabilities
The current count of unremediated critical vulnerabilities, ideally with ageing (how long each has been open). A simple, honest snapshot of outstanding high-severity exposure.
Set your target
The aspirational target is a small, stable, young backlog rather than a specific number pulled from elsewhere. Watch the ageing distribution: old open criticals are the real story. Set an internal ceiling on how long any critical may remain open and manage to that.
Mean Time to Remediate (by severity) · MTTR-vuln
The average time to close a vulnerability once discovered, broken down by severity. Distinct from patch latency: it covers all remediation, including config changes and compensating controls.
Set your target
Tie targets to your severity SLAs and improve against your own baseline. Track the median alongside the mean so a few long-tail items do not mask steady performance, and set the tightest target for the severity that maps to real exploitability in your estate.
External Attack Surface Size
The count of internet-exposed assets, services and ports attributable to your organisation. What an external attacker sees first; growth here is often unmanaged shadow infrastructure.
Set your target
Aim to minimise and, above all, to know your surface — an unexpected exposure matters more than the raw count. Baseline with external discovery, then target zero unknown or unapproved exposures and a shrinking footprint of anything not justified by a business need.
MFA Coverage
The proportion of accounts — especially privileged and remote-access accounts — protected by multi-factor authentication. One of the highest-leverage controls against credential attacks.
Set your target
Drive privileged and external-facing accounts to full enforcement as a non-negotiable, and track remaining gaps as exceptions with owners and dates. The meaningful target is complete coverage of the accounts that matter, measured by enforcement, not by availability of the option.
Privileged Account Count
The number of accounts holding elevated or administrative privilege. Every privileged account is a high-value target, so the count — and its trend — is a direct measure of concentrated risk.
Set your target
The goal is the smallest number consistent with operations, achieved through just-in-time elevation and regular review rather than a fixed quota. Baseline the current count, then reduce standing privilege by moving to time-bound access, and justify each remaining permanent admin.
Mean Time to Revoke Access
The average time to remove a user’s access after they leave or change role. Lingering access for departed staff and stale entitlements is a recurring source of breaches and audit findings.
Set your target
Set a tight target for revoking access on termination (ideally same-day for privileged access) and measure from the effective leave date, not when IT was told. Improve against your baseline and prioritise automation of joiner-mover-leaver flows, which is what actually shrinks this.
Dormant / Inactive Account Count
The number of enabled accounts with no recent activity. Dormant accounts are quietly exploitable — they are enabled, often still entitled, and no one is watching them.
Set your target
Define your inactivity threshold explicitly, then aim to keep dormant enabled accounts near zero through automatic disablement. Baseline the current count and set a cadence for disabling or removing accounts that cross the threshold, with a short grace period for genuine edge cases.
Access Review / Recertification Completion
The share of scheduled access reviews completed on time, and the share of entitlements actually recertified. Measures whether least privilege is maintained or just asserted.
Set your target
Target full, on-time completion of scheduled reviews, and watch the rubber-stamp risk: track how many entitlements are actually revoked during reviews, not just that reviews happened. A review that never removes anything is a process, not a control.
Exposed / Leaked Credential Count
The number of organisational credentials found exposed in breach dumps, paste sites or code repositories. A direct feed of accounts an attacker may already be able to use.
Set your target
The operational target is a fast, reliable response — every exposed credential forced to reset — rather than a particular count, which you do not fully control. Measure time from discovery to reset and drive that down, and track repeat exposures as a signal of a deeper hygiene problem.
Non-Human / Service Identity Count
The number of service accounts, API keys, tokens and workload identities, ideally with ownership and last-use. Machine identities now vastly outnumber human ones and are frequently over-privileged and unrotated.
Set your target
The goal is full attribution (every machine identity has a known owner and purpose) and least privilege, not a cap on the number. Baseline the inventory, then drive down orphaned and unrotated identities and the share holding excessive permissions.
Phishing Simulation Click Rate
The proportion of staff who click a link or open an attachment in a simulated phishing exercise. A proxy for susceptibility to the most common initial-access technique.
Set your target
Judge this against your own trend and the difficulty of each lure, not an external percentage — an easy template and a hard one are not comparable. Hold lure difficulty roughly constant to make the trend meaningful, and pair click rate with report rate so you measure resilience, not just failure.
Phishing Reporting Rate
The proportion of staff who correctly report a simulated (or real) phishing message. A positive-behaviour metric: reporting turns every employee into a sensor for the SOC.
Set your target
Set an improving target against your own baseline and make reporting frictionless (a one-click button). Watch the ratio of reporters to clickers over time — rising reporting with steady or falling clicks is the behaviour change you want, regardless of any external figure.
Median Time to Report Phishing
How quickly the first accurate report of a phishing message reaches the SOC. Fast reporting shortens the window between a campaign landing and your team being able to contain it.
Set your target
Drive the median down against your own baseline; the earliest report is what matters operationally, so track the first report, not the average. Combine with reporting rate — fast reporting from a small fraction of staff is still valuable but shows where awareness has further to go.
Security Training Completion
The proportion of staff who have completed required security awareness training within the assigned window. A compliance baseline and a prerequisite for the behavioural metrics above to mean anything.
Set your target
Target full on-time completion, since this is usually a compliance obligation, but treat completion as a floor, not evidence of effectiveness — click and report rates measure whether the training changed behaviour. Track high-risk-role completion separately.
Repeat Clicker Rate
The proportion of staff who click in phishing simulations more than once across campaigns. Identifies the persistent, concentrated human risk that averages hide.
Set your target
Focus on driving this toward zero for repeat offenders through targeted coaching rather than broad training. Baseline against your own population; the value is in identifying and supporting the small group that drives most real-world risk, not in a headline number.
Backup Success Rate
The proportion of scheduled backups that complete successfully. The first half of recoverability — a backup that silently fails is discovered only when you need it most.
Set your target
Target near-perfect success for critical systems and alert on any failure rather than tolerating a percentage of silent misses. The number alone is not recoverability — pair it with restore testing, below, which is the half that actually proves you can come back.
Restore / Recovery Test Rate
The proportion of critical systems whose backups have been successfully test-restored within a defined window. The only metric that proves a backup actually works.
Set your target
Aim for every critical system to have a recent, successful, timed restore test — an untested backup should count as no backup in your reporting. Set the test cadence by system criticality and record the restore duration so it feeds your RTO evidence.
RTO / RPO Adherence
Whether actual recovery time and data-loss window in tests (and real events) meet the recovery time and recovery point objectives you have committed to. Measures resilience against your own promises.
Set your target
First set defensible RTO/RPO values per system with the business, then measure adherence against those in realistic exercises. The target is consistently meeting your own objectives; a gap means either the recovery capability or the objective needs to change, which is the useful conversation.
DR / Failover Test Frequency & Success
How often disaster-recovery and failover exercises are run, and how many succeed. Resilience decays silently as systems change, so cadence and outcome together keep the capability real.
Set your target
Set a test cadence proportionate to how fast your environment changes, and target running the planned tests and improving their success rate. Treat a failed DR test as a valuable finding, not a bad score — the point is to fail in a drill rather than an incident.
Critical System Availability
The uptime of security-critical and business-critical systems against their availability objectives. Where security and operational resilience overlap, since downtime is often an incident outcome.
Set your target
Use the availability objective already agreed with the business for each system rather than inventing one. Track adherence and investigate security-caused downtime separately, so the metric distinguishes resilience from routine operational outages.
Control Coverage vs Framework
The share of a chosen control framework that your environment implements and can evidence. A posture map that shows where you are strong, thin, or simply have not assessed.
Set your target
Scope to the controls applicable to you and count only those you can actually evidence, or the figure flatters you. Target steady improvement toward full coverage of in-scope controls, and treat "implemented but unevidenced" as not-yet-covered for reporting honesty.
Policy Exception Count & Ageing
The number of active exceptions to security policy and how long they have been open. Exceptions are accepted risk made visible; a growing or ageing pile is risk accumulating by default.
Set your target
Aim for a small set of exceptions, each with an owner, an expiry and a review — the enemy is the permanent, forgotten exception. Set an internal limit on how long an exception may live without re-approval and manage the ageing distribution to it.
Audit Finding Closure Rate
The proportion of audit and assessment findings remediated within their agreed timelines. Measures whether known problems are actually fixed or just logged and forgotten.
Set your target
Target high, on-time closure and track overdue findings by severity and age separately. The useful signal is the ageing of open findings; set a ceiling on how long a high-severity finding may remain open and drive repeat findings — the same issue recurring — toward zero.
Accepted Risk Count & Ageing
The inventory of formally accepted risks and how long each has been accepted. Keeps deliberate risk decisions visible and prevents a temporary acceptance from quietly becoming permanent.
Set your target
There is no right count — the target is that every accepted risk has a named owner, a quantified rationale and a hard review date. Use FAIR to express the exposure in loss terms so acceptance is an informed decision, and force re-review on expiry rather than letting acceptances roll over.
Security Spend Ratio
Security investment expressed as a share of IT (or total) spend, often split across people, tooling and services. A budgeting and benchmarking input for leadership conversations.
Set your target
Resist treating any external percentage as the right level — appropriate spend depends on your risk profile, regulatory exposure and threat model. Use this to track your own allocation and to frame risk-based investment cases, deriving the target from the risk you are choosing to buy down, not from a peer figure.
Third-Party Assessment Coverage
The proportion of in-scope vendors and suppliers that have a current, completed security assessment. Supply-chain risk is only managed for the vendors you have actually looked at.
Set your target
Tier vendors by the risk they carry (data access, criticality) and target full, current coverage of the high-risk tier before worrying about the long tail. "Current" matters — set an expiry on assessments so coverage reflects fresh reviews, not a one-time questionnaire years ago.
Vendor Remediation SLA Adherence
How reliably vendors fix the security issues you raise within agreed timelines. Turns vendor risk management from a questionnaire into measured accountability.
Set your target
Set remediation expectations in contracts where you can, then measure adherence per vendor and escalate the laggards. The target is reliable, on-time remediation by critical vendors; use the data in renewals rather than chasing a single blended figure.
Fourth-Party / Concentration Risk
The degree to which many of your vendors depend on the same underlying providers, creating a single point of failure beyond your direct suppliers. A map of correlated supply-chain exposure.
Set your target
This is a risk-identification metric, not a target to hit. Map your fourth-party dependencies and flag where too much rides on one upstream provider; the goal is informed concentration decisions and contingency planning, with exposure framed in FAIR loss terms.
Vendor Offboarding / Access Revocation
Whether departing vendors have their access and data promptly revoked and returned. Offboarding is the step most often skipped, leaving live access for a relationship that has ended.
Set your target
Target complete, timely offboarding for every terminated vendor and measure from the contract end date. Keep an auditable record of access removed and data returned or destroyed; the risk is the silent, forgotten credential, so near-full adherence is the only acceptable aim.
AI / Model Inventory Coverage
The proportion of AI/ML systems, models and LLM-powered features in use that are recorded in a governed inventory with an owner and purpose. You cannot secure or govern AI you do not know you run.
Set your target
Target full coverage of AI systems against an actively-maintained inventory, and separately drive down the discovered-but-unregistered set (see shadow-AI). "Known" must include active discovery, not just self-declared use, or the denominator understates reality.
Shadow-AI Detections
The number of unsanctioned AI tools and LLM services discovered in use — staff pasting data into public chatbots, ungoverned API usage, unapproved copilots. The AI-era analogue of shadow IT.
Set your target
Rising detections early on usually mean better visibility, not worsening behaviour, so judge the trend in context. The real target is a fast path from detection to either sanctioning or blocking, plus a falling share of data-sensitive usage going to ungoverned tools. Measure response, not just count.
Prompt-Injection Test Pass Rate
The share of prompt-injection and jailbreak test cases your LLM applications resist in structured testing. Prompt injection is the headline LLM vulnerability class, and this measures how your defences hold up.
Set your target
Build a growing, versioned test suite from known injection techniques and your own red-team findings, and target an improving pass rate against it release over release. Treat a drop after a model or prompt change as a regression to block, and never read a high score as proof of safety against novel attacks.
AI Red-Team Finding Closure
The proportion of findings from AI/LLM red-teaming that are remediated within agreed timelines, by severity. Applies the same accountability to AI risk that you expect for traditional findings.
Set your target
Set severity-based SLAs for AI findings as you would for any other, and target high, on-time closure. Because AI behaviour shifts with model updates, track re-test results, not just first closure — a fix that a later model version undoes has not held.
Model Provenance / AIBOM Coverage
The share of deployed models for which you hold provenance — an AI Bill of Materials covering source, training-data lineage, weights, licence and dependencies. Supply-chain transparency for AI.
Set your target
Target full provenance coverage for models in production, prioritising those touching sensitive data or regulated decisions. Define what a complete AIBOM must contain for you first; partial records should not count as covered, or the metric overstates your transparency.
LLM Output-Validation Coverage
The proportion of LLM-powered features whose outputs pass through validation, filtering or guardrails before use — rather than being trusted and acted on raw. Core defence against unsafe or injected model output.
Set your target
Target full coverage for any feature where model output reaches users, triggers actions or enters another system, weighted by the consequence of a bad output. Validate that the guardrails actually work (via the injection and bypass tests) rather than merely counting features that have one wired in.
AI Agent Autonomy Level
The degree of autonomous action granted to AI agents — from suggest-only, through human-approved, to fully autonomous with real-world side effects. A risk-exposure measure for agentic systems and their blast radius.
Set your target
This is a risk-posture metric, not a score to maximise. Define explicit autonomy tiers, require higher assurance and tighter scoping as autonomy rises, and set the target as a deliberate, reviewed distribution — keeping high-consequence actions behind a human-in-the-loop unless you have strong evidence to remove it.
AI Data-Leakage Incidents
The count of confirmed cases where sensitive data left your control through an AI system — leaked in a prompt, surfaced in output, or exposed via an ungoverned model. The realised-harm metric for AI data risk.
Set your target
As with any realised-harm count, the aim is zero confirmed leakage of sensitive data, achieved through prevention (classification, DLP on AI pathways, output validation). Early detections may rise as monitoring improves; pair the count with mean time to detect and contain AI leakage, and investigate each case for a systemic cause.
RAG Source-Grounding / Citation Rate
For retrieval-augmented features, the share of responses that are actually grounded in and correctly cite the retrieved sources rather than fabricated. A trust and accuracy control against hallucination.
Set your target
Define grounding precisely (the claim is supported by a cited source) and evaluate on a representative, regularly-refreshed sample rather than cherry-picked prompts. Target an improving rate for the use cases where a confident fabrication does real harm, and treat a drop after a model or retrieval change as a regression.
AI Vendor / Model Risk Assessment Coverage
The proportion of third-party AI models and AI-powered vendor services that have a completed, current risk assessment covering data handling, security and governance. Extends third-party risk to the AI supply chain.
Set your target
Tier AI vendors by data sensitivity and decision impact, and target full, current coverage of the high-risk tier first. Assess the specifics that matter for AI — training-data use, retention, model updates, sub-processors — rather than reusing a generic vendor questionnaire, and expire assessments so coverage stays fresh.
Guardrail Bypass Rate
The share of attempts that successfully circumvent your AI safety guardrails or content policies in testing (and, where observable, in production). Measures how often your controls can be talked around.
Set your target
Maintain a versioned, expanding bypass test set drawn from real techniques and your own red-team results, and drive the bypass rate down release over release for the categories that carry real consequence. A rising rate after any model or prompt change is a regression to block before shipping; a zero in testing is not proof against novel attacks.
Risk-score builder
· weight the metrics that matter, rate yourself, get a compositeAdd metrics from the catalog above with + Add, then weight each one and rate where you stand against your own target.
Everything here is computed on-screen for free. Exports are the only Pro feature.
Educational self-assessment. The catalog describes real, widely-used security metrics; every figure in the scorecard is derived from the weights and self-ratings you enter, and the bands are PlayCISO's own transparent rubric for structured reflection — not a measurement, certification, or guarantee, and not based on any real-world average or benchmark number. The "how to set your target" guidance deliberately tells you to baseline and choose your own targets rather than quoting figures that would be fabricated. The tool makes no network calls and runs entirely in your browser.
Security metrics — frequently asked
What are security metrics and security KPIs?
Security metrics are quantified measures of how a security programme is performing — for example mean time to detect (MTTD), mean time to respond (MTTR), patch latency, the percentage of critical vulnerabilities remediated within SLA, MFA coverage, or phishing-simulation click and report rates. A security KPI (key performance indicator) is a metric chosen because it tracks progress toward a specific objective, such as reducing the time an attacker goes unnoticed or raising how reliably staff report phishing. Good metrics are measurable from data you already hold, tied to a decision or a target, and tracked as a trend rather than read as a single number. This library catalogs real, widely-used metrics across detection and response, vulnerability management, identity, awareness, resilience, governance and third-party risk, plus a dedicated AI-security section.
What are AI security metrics?
AI security metrics measure the risk and assurance of AI, machine-learning and large-language-model systems you run in production — risks that classic security metrics do not cover. Examples in this library include AI/model inventory coverage (do you even know what AI you run), shadow-AI detections (unsanctioned AI tools in use), prompt-injection test pass rate, AI red-team finding closure, model provenance or AIBOM (AI Bill of Materials) coverage, LLM output-validation coverage, AI agent autonomy level, AI data-leakage incidents, RAG source-grounding and citation rate, AI vendor and model risk-assessment coverage, and guardrail bypass rate. They map to emerging frameworks such as the NIST AI Risk Management Framework, ISO 42001, the OWASP Top 10 for LLM Applications and MITRE ATLAS, and they matter because an AI feature can leak data, be manipulated by a crafted prompt, or act autonomously in ways a traditional metric would never surface.
How do I choose the right security metrics for a dashboard?
Start from the decisions and audiences the dashboard serves. A board wants a small number of outcome and risk metrics (incident cost, control coverage, major risks accepted); a CISO wants programme health (MTTD/MTTR trends, critical-vuln SLA adherence, MFA coverage); a SOC wants operational signals (alert volume, dwell time, false-positive rate). Pick metrics you can measure reliably from existing data, weight them by what matters most to your risk, and track trends rather than isolated figures. In this library you can filter metrics by audience, category and framework, select the ones that fit, weight them and rate where you stand to produce a transparent composite posture score — all in your browser. Avoid vanity metrics (counts with no decision attached) and never anchor a target to a borrowed industry-average figure; set targets from your own baseline.
What security frameworks do these metrics map to?
The metrics in this library map to the frameworks teams actually report against: the NIST Cybersecurity Framework (CSF), ISO 27001, the CIS Controls, PCI DSS and SOC 2 for classic security domains; FAIR for quantifying risk in financial terms; MITRE ATT&CK (and ATLAS for AI) for detection coverage; and, for AI specifically, the NIST AI Risk Management Framework, ISO 42001 and the OWASP Top 10 for LLM Applications. Each metric lists the frameworks it supports so you can assemble a metric set aligned to the standard you are audited or benchmarked against. The library lets you filter by framework to find every metric relevant to one.
Does the library include industry-average benchmark numbers?
No — deliberately. There are no fabricated "industry average" or benchmark figures anywhere in this library, because a made-up number does more harm than good when it becomes a target. Instead, every metric includes plain-English guidance on how to set your own target: baseline your current value over a few cycles, set an improvement goal against that baseline, and track the trend. The risk-score builder is the same: its composite score and its bands are PlayCISO’s own transparent rubric for structured self-reflection, computed entirely from the weights and self-ratings you enter — not a measurement against anyone else’s data.