Lesson 2.28: KPIs and KRIs that drive decisions
A security programme is judged by numbers, and most security numbers are noise: emails blocked, rules written, videos watched. Useful measures either show whether the programme performs (key performance indicators, such as mean time to detect) or warn that risk is rising past what the organisation accepts (key risk indicators, with thresholds). In the lab you compute detection and containment times per quarter from incident records, check who finds incidents, test the KRIs against their thresholds and cut the metrics that don't drive any decision.
18 min
You will learn to
- Tell KPIs, KRIs and activity counts apart
- Compute MTTD and MTTC per quarter from incident records
- Measure how many incidents are found internally
- Test KRIs against thresholds
- Keep only metrics that drive a decision
Key terms
- KPI
- Key performance indicator: shows whether the programme achieves its goals.
- KRI
- Key risk indicator: warns that a risk is approaching or past the accepted level; has a threshold and an escalation.
- MTTD / MTTC
- Mean time to detect / to contain an incident.
- Activity metric
- A count of work done (alerts, blocks, trainings) that doesn't show effect.
- Threshold
- The value at which an indicator requires action.
← Business impact analysis · All lessons · Keeping a policy framework alive →