Cybersecurity Metrics Development for Board and Risk Committee Reporting
summary
Shows how 300–350 raw metrics are condensed into a vetted set mapped to cost, maturity, risk and explains a repeatable timeline: assess for two weeks, draft and peer-review at four weeks, validate over two to three months. Recommends concrete measures like mean time to detection and phish-prone rate, plus counts and criticality of vuln and pen-test findings, links metrics to MITRE ATT&CK techniques, and argues for a reporting cadence (monthly where possible) that produces actionable board decisions.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:19Cyber Metric Reporting Utility
- 3:23Common Cyber Metrics
- 12:30Cyber Metrics Development Process
- 17:20Evaluation and Rotation of Cyber Metrics
- 21:13Cyber Metrics Survey and Analysis
- 23:41Cyber Metrics Research Results
- 28:42Takeaways and Application
- 35:03Summary
related talks
28mHow to Tell the Right Cyber-Story to Executives and Board Members
53mMetrics that Matter.Confidence & Resilience in Your Security Program
50mSoftware Security Metrics
59mKeynote: Measure Security Effectively
35mMetrics That Matter: How to Choose Cloud Security KPIs for Your Business
27mProduct Security Vulnerability Management Metrics are Hard
15mFrom Risk to Return: Measuring Cybersecurity ROI with Data Analytics
25mSecurity Metrics: Protecting Our Digital Assets of the Future