Chapter 13 — Security KPIs and Metrics

13.1 Preventive Security Metrics

Access Control Metrics

Metric	Target	Measurement Frequency	Data Source
MFA Adoption Rate	100%	Daily	Identity Provider Logs
Privileged Account Coverage	100%	Weekly	IAM Audit Logs
Access Review Completion	100%	Monthly	Access Review System
Unused Account Cleanup	< 30 days	Weekly	IAM Usage Reports
Policy Violation Rate	< 5%	Daily	Compliance Scanner

Configuration Management Metrics

PreventiveMetrics:
  Hardening_Compliance:
    - Metric: "System hardening compliance rate"
      Target: "95%"
      Frequency: "Daily"
      Source: "Configuration Scanner"

    - Metric: "Security configuration drift"
      Target: "0%"
      Frequency: "Hourly"
      Source: "Config Management Tool"

  Patch_Management:
    - Metric: "Critical vulnerability patch time"
      Target: "< 7 days"
      Frequency: "Daily"
      Source: "Vulnerability Scanner"

    - Metric: "Patch compliance rate"
      Target: "> 95%"
      Frequency: "Weekly"
      Source: "Patch Management System"

  Encryption_Coverage:
    - Metric: "Encrypted data storage percentage"
      Target: "100%"
      Frequency: "Daily"
      Source: "Storage Inventory"

    - Metric: "TLS/HTTPS compliance rate"
      Target: "100%"
      Frequency: "Continuous"
      Source: "Network Monitoring"

13.2 Detective Security Metrics

Detection Performance Metrics

Metric	Target	Measurement Frequency	Alert Threshold
Mean Time to Detect (MTTD)	< 15 minutes	Per incident	> 30 minutes
False Positive Rate	< 10%	Monthly	> 15%
Alert Coverage	100% of controls	Quarterly	< 95%
Monitoring System Availability	99.9%	Continuous	< 99.5%
Log Collection Completeness	100%	Daily	< 98%

Threat Detection Metrics

DetectiveMetrics:
  Threat_Identification:
    - Metric: "Threat detection accuracy"
      Target: "> 95%"
      Frequency: "Monthly"
      Calculation: "True Positives / (True Positives + False Negatives)"

    - Metric: "Mean time to analyze alerts"
      Target: "< 30 minutes"
      Frequency: "Per alert"
      Measurement: "Alert creation to initial triage"

  Behavioral_Analysis:
    - Metric: "Anomalous behavior detection rate"
      Target: "> 80%"
      Frequency: "Weekly"
      Source: "UBA System"

    - Metric: "Baseline accuracy"
      Target: "> 90%"
      Frequency: "Monthly"
      Measurement: "Normal vs anomalous classification"

13.3 Responsive Security Metrics

Incident Response Metrics

Metric	Target	Measurement Frequency	Industry Benchmark
Mean Time to Respond (MTTR)	< 1 hour	Per incident	4-6 hours
Mean Time to Contain	< 4 hours	Per incident	8-12 hours
Mean Time to Recover	< 8 hours	Per incident	24-48 hours
Incident Resolution Rate	100%	Monthly	85-95%
Post-Incident Review Completion	100%	Per incident	60-80%

Response Effectiveness Metrics

ResponsiveMetrics:
  Response_Quality:
    - Metric: "Incident containment success rate"
      Target: "100%"
      Frequency: "Per incident"
      Measurement: "Successful containment attempts"

    - Metric: "Data loss prevention rate"
      Target: "100%"
      Frequency: "Per incident"
      Measurement: "Data protected vs data exposed"

  Communication_Effectiveness:
    - Metric: "Stakeholder notification timeliness"
      Target: "< 30 minutes from detection"
      Frequency: "Per incident"
      Measurement: "Detection to notification time"

    - Metric: "Customer communication accuracy"
      Target: "100% accurate information"
      Frequency: "Per incident"
      Measurement: "Information correctness review"

13.4 Business Impact Metrics

Security ROI Metrics

Metric	Target	Measurement	Business Value
Security Cost per Revenue	< 1%	Quarterly	Cost efficiency
Security Incidents Cost Reduction	> 20% YoY	Annually	Loss prevention
Compliance Fine Avoidance	100%	Annually	Regulatory compliance
Customer Trust Score	> 90%	Quarterly	Business reputation
Security Investment ROI	> 200%	Annually	Financial performance

Operational Excellence Metrics

BusinessMetrics:
  Operational_Efficiency:
    - Metric: "Security automation rate"
      Target: "> 80%"
      Frequency: "Quarterly"
      Business_Value: "Reduced operational overhead"

    - Metric: "Security tool utilization"
      Target: "> 90%"
      Frequency: "Monthly"
      Business_Value: "Maximized tool investment"

  Business_Enabler:
    - Metric: "Security approval time"
      Target: "< 2 business days"
      Frequency: "Per request"
      Business_Value: "Faster time to market"

    - Metric: "Developer security satisfaction"
      Target: "> 85%"
      Frequency: "Quarterly survey"
      Business_Value: "Developer productivity"

13.5 Metrics Dashboard Implementation

Executive Dashboard

ExecutiveDashboard:
  Key_Indicators:
    - Overall Security Posture Score (0-100)
    - Risk Exposure Level
    - Compliance Percentage
    - Security Budget vs Actual
    - Incident Trends (30-day view)

  Visualizations:
    - Risk heatmap
    - Compliance radar chart
    - Cost trend analysis
    - Incident timeline
    - Performance comparisons

  Update_Frequency: "Real-time updates, daily summary"

Operational Dashboard

OperationalDashboard:
  Real_Time_Metrics:
    - Active alerts by severity
    - Threat detection rates
    - System availability
    - Response queue status
    - Resource utilization

  Historical_Analysis:
    - Incident trends (12-month view)
    - Detection performance
    - Response effectiveness
    - Vulnerability remediation
    - Compliance drift analysis

  Alerts_and_Notifications:
    - Critical incident alerts
    - SLA breach warnings
    - System health alerts
    - Performance threshold breaches