Security Metrics That Survive Board Scrutiny

Why this matters

Boards want numbers, not narrative. The metrics that work: incidents/quarter by severity (trend), mean-time-to-detect (trend), mean-time-to-respond (trend), bug-bounty findings (trend), regulator MRAs open (target zero), training completion rate, third-party assessments completed/quarter, percentage of features with completed threat models. Each is leading or lagging — together they tell whether the program is healthy.

Demo

Recommendation: ship a one-page security scorecard quarterly: 8 metrics with trends + RAG status + one paragraph commentary. The CFO understands it because it looks like a P&L. The CEO understands it because it has trends. The board understands it because it's bounded to one page.

Try it yourself

1. Try to hack your scorecard: pick three of the eight metrics above. Compute the current value. If you can't compute one in under an hour, you're not measuring it.
2. Compare to Slack's, GitHub's, or Coinbase's published security metrics (in 10-K filings).
3. Audit: how often does your board see security metrics? Quarterly is the baseline; less is malpractice.

References

• Cyentia — Security Metrics
• Risk5 framework