Board Metrics Selection Lab
You get one slide and a few minutes with the board. So which numbers go on it? The ones that map to a decision the board makes and tie to its risk appetite — not the millions-of-attacks-blocked vanity tiles that crowd them out. Sit in the seat that builds the deck and make each call the way a good chair would judge it: signal over vanity, leading and laggingtogether, the trend not a snapshot, every metric with an owner and a target. Each decision shows you why.
Pair this drill with the free Board Cyber Metrics (KPI/KRI) Dashboard template — the curated metric set this lab teaches you to build. Educational drill for orientation, adapted to your own board.
The real job. More noise, a tighter clock.
You are building the quarterly cyber slide for the board. Work 10 decisions about which metrics earn a place — the few that map to a board decision and tie to risk appetite — and which are vanity numbers that crowd them out. Make the defensible call, then see why. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on choosing board-grade cyber metrics: work ~14 decisions about which numbers earn a place on the board deck and which are vanity filler.
- The one test for a board metric: does it map to a decision the board actually makes — fund, accept, escalate, or hold the company to its risk appetite?
- You practise the real distinctions: signal vs vanity (blocked-attack counts, alert volumes, patches applied), leading vs lagging indicators, trend vs a point-in-time snapshot, KRIs tied to appetite thresholds, owners and targets, and RAG-against-a-threshold over raw numbers.
- Each decision reveals why the board-defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill. Pair it with the free Board Cyber Metrics (KPI/KRI) Dashboard template.
Frequently asked questions
What is the Board Metrics Selection Lab?
A free, in-browser decision simulation that puts you in the seat of the person building the quarterly cyber slide for the board. You work through decisions — is this a board metric or a vanity number, is it leading or lagging, should it be a trend or a snapshot, does it tie to risk appetite — and each one has a single defensible answer, revealed after you lock in your call.
What makes a cyber metric "board-grade"?
The test is whether the metric maps to a decision the board can actually make: where to spend, what risk to accept, when to escalate, and whether the company is inside its stated risk appetite. A big impressive number like "millions of attacks blocked" maps to no board decision and is vanity; a KRI tracked against an appetite threshold, with an owner, a target and a trend, is board-grade.
What is the difference between leading and lagging indicators?
Leading indicators measure the strength of your defences and predict future risk — patch-SLA attainment, percent of critical assets with EDR, training completion, control coverage. Lagging indicators report outcomes that already happened — incidents, MTTD/MTTR, audit findings. A board set needs both: leading to steer, lagging to verify.
Is this training material or advice?
It is an educational drill. The principles — signal over vanity, metrics mapped to decisions, KRIs tied to appetite, trend over snapshot — are presented for orientation and reflect widely-used board-reporting practice; adapt them to your own board’s risk appetite and reporting standards.