Monitoring and Evaluating Security Performance

One of the most important and frequently neglected aspects of security management is the systematic measurement of how well security controls and processes are performing. Organisations that invest in security without measuring its effectiveness are, in effect, flying blind: they cannot distinguish between security measures that are working and those that are not, they cannot demonstrate the value of their investment to stakeholders, and they cannot identify where improvement effort should be directed.

Monitoring security performance is not the same as conducting a risk assessment or an internal audit. It is an ongoing, operational activity that tracks specific, measurable indicators of security health over time, enabling organisations to identify trends, detect deterioration and demonstrate progress. According to PWC, only 22%of chief executives feel confident that their risk exposure data is comprehensive enough for sound decision-making, underscoring how widespread this gap remains.

Security Metrics and Key Performance Indicators

A security metric is a specific, measurable data point that provides information about an aspect of an organisation’s security posture. A key performance indicator (KPI) is a strategic, rate-based measurement tied to a specific security objective or business outcome. The distinction matters: metrics describe the current state; KPIs track progress towards defined goals.

Well-chosen security metrics and KPIs should be relevant to the risks the organisation faces, measurable with available data, actionable in the sense that they point to specific improvements, and reported to the right audience in a format they can understand and act upon. A metric that is technically accurate but incomprehensible to its audience serves no useful purpose.

Key Metrics Every Manager Should Understand

• Mean Time to Detect (MTTD): the average time between the occurrence of a security incident and its discovery by the organisation. A high MTTD indicates weaknesses in monitoring, detection processes or reporting culture. IBM’s Cost of a Data Breach Report has consistently found that shorter detection times correlate strongly with lower breach costs: organisations that detect breaches within 200 days incur significantly lower costs than those that take longer. Reducing MTTD is one of the highest-value investments any organisation can make.
• Mean Time to Respond (MTTR): the average time between the detection of an incident and its containment or resolution. A high MTTR indicates weaknesses in incident response planning, team readiness or the availability of necessary resources and decision-making authority. Together with MTTD, MTTR provides a comprehensive view of an organisation’s ability to limit the damage of a security incident once it has occurred.
• Phishing simulation success rate: the percentage of staff who click on a simulated phishing email during a security awareness exercise. This metric directly measures one of the most significant human vulnerabilities in any organisation’s security posture and provides a baseline against which the effectiveness of security awareness training can be measured over time.
• Patch compliance rate: the percentage of systems within the organisation’s scope that have applied required security patches within the defined timeframe. As established in Week 3, unpatched vulnerabilities are one of the most common initial access vectors for attacks. A patch compliance rate below 100% means that known vulnerabilities remain open and exploitable; understanding the gap and its causes is a management responsibility.
• Number of security incidents reported: the total number of security concerns, suspicious activities and potential incidents reported by staff over a given period. Counterintuitively, a low number is not necessarily a good sign. It may reflect a strong security culture and effective controls, but it may equally reflect an absence of reporting culture in which staff do not know how to report concerns or fear doing so. Tracking this metric over time, alongside the outcomes of reported incidents, provides insight into both the threat environment and the health of the reporting culture.
• Access review completion rate: the percentage of access reviews scheduled in a given period that have been completed on time. As established in previous weeks, inadequate access management is a consistently significant vulnerability. Tracking whether access reviews are actually being conducted, and whether the findings are being acted upon, is a basic but important management accountability measure.
• Third-party security assessment completion: the percentage of suppliers assessed against the organisation’s security requirements during a given period. Given that third-party involvement in breaches doubled in the Verizon 2025 DBIR, tracking how comprehensively the organisation’s supplier ecosystem is being assessed is increasingly important.

Reporting Security Performance to Stakeholders

Security performance information serves different audiences who need different presentations of the same underlying data. Technical security teams need detailed operational metrics. Senior leaders and boards need strategic summaries that connect security performance to business risk and organisational objectives. Regulators and auditors need evidence of control effectiveness and compliance. Mid-level managers need operational indicators relevant to their team’s specific environment and responsibilities.

For managers, the most important implication of security performance monitoring is that it creates visibility and accountability. If your team’s phishing simulation click rate is consistently high, that is a documented finding that calls for a response. If access reviews in your area are routinely late or incomplete, that is a measurable control gap. Security performance measurement transforms abstract policy commitments into concrete, auditable evidence of whether security is working in practice, and it is in the day-to-day work of teams and their managers where that evidence is most clearly generated.