Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Edge Articles

07:00 AM
Ericka Chickowski
Ericka Chickowski
Edge Features
Connect Directly

The 20 Worst Metrics in Cybersecurity

Security leaders are increasingly making their case through metrics, as well they should - as long as they're not one of these.

After a decade or more of exhortations from cybersecurity pundits that CISOs need to be more data-driven and speak in the language of business — namely through numbers and measurement — the metrics message is finally sinking in. Whether it is to justify spending, quantify risk, or generally keep the executive suite up on security doings, CISOs discussions are now awash in dashboards, charts, and key performance indicators. The only problem? A lot of the numbers security teams and their leadership uses are, well, not very useful.

In fact, many of the measurements made are vanity metrics, presented with little context, collected in volume with little analysis, and often instrumented to the wrong observables to truly communicate risk. The Edge recently asked security experts around the industry about their least favorite metrics — and boy did they have a lot to say. The following are 20 of the worst metrics in cybersecurity, as described by the people who live and breathe security every day.

(Image: maxxasatori via Adobe Stock)

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
1 of 21

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
6/29/2020 | 9:04:13 AM
Re: So many bad metrics...
Agreed. Clicking thru these 21 pages was an utter waste of time.

Meaningful cyber metrics is a very challenging field. Besides the clickbait title, "The Top 20 BEST Cyber Metrics"  should never be written. The field is too wide. 

To hit a home run, go ask the BoD, CEO or Chief Risk Officer what metrics help them make strategic decisions. Everything else is busywork and job justification.
User Rank: Apprentice
9/19/2019 | 9:03:32 AM
So many bad metrics...
What's left?  How about a follow up on the 20 best metrics?
Flash Poll