Key Performance Indicators (KPIs) are critical to any security program, and most security leaders already know it. Nonetheless, in practice, confusion remains about which cybersecurity KPIs actually belong on a SOC dashboard and which ones just add noise. re crucial to track and how to choose the right KPIs to measure and improve the robustness of your security program.
Here we’ll propose a few ideas about how to select and track the right KPIs for your organization.
Security KPIs and security metrics: are they the same?
At the outset, we need to make a few clarifications.
Security KPIs and security metrics are terms often used interchangeably, but there is a slight difference between their meanings. While metrics are “quantifiable measurements” that pertain primarily to your security tactics and day-to-day measurement of results, your KPIs are measurables tied to your long-term security strategy and ultimate goals. Your chosen security KPIs drive crucial strategic decisions, so your security program’s credibility rests on them.
Security metrics is the broader concept of the two. Security KPIs are simply security metrics that carry more weight for an organization than the rest of the security metrics.
By security, we mean both cybersecurity and information security, so you’ll see“security KPIs,” “cyber security KPIs,” and “cybersecurity KPIs” interchangeably (somewhat loosely, some might say). The same applies to “security metrics” and “cybersecurity metrics.”
How to choose your security KPIs
Quality
When choosing cybersecurity KPIs, quality should always outrank quantity. In this case, quality is synonymous with effectiveness.
An effective security KPI should be:
- Simple
- Measurable
- Actionable
- Relevant
- Time-based
Quantity
Tracking too many KPIs can place decision-makers in a state of information overload.
To decide what KPIs you should monitor without falling down that rabbit hole, ask two simple questions:
- Will this KPI inspire meaningful change in your organization?
- Can it be adapted to address unforeseen shortcomings of your security program or increase its applicability?
Security KPIs measured in security operations
Below is a small list of selected critical cybersecurity metrics, i.e., KPIs that Security Operations Centers (SOCs) usually measure. In addition, the list contains some key questions you need to answer when considering whether a cybersecurity metric is a suitable KPI for your company.
| KPI | Questions to consider |
| Mean Time to Detect (MTTD) | Are there alternative procedures to reduce the time to detect? |
Mean Time to Respond (MTTR) | Are there ways to improve the response phases? |
Mean Time to Contain (MTTC) | Can containment techniques be enhanced? |
| Total number of incidents | How many security incidents are being handled? |
Number of false positives | Is there an opportunity for automation to help address the SecOps pain points? |
| Time to identify an alert as a false positive | Can the time for the discovery of false positives be shortened? |
| Number of devices being monitored | Which devices pose the greatest attack risk? |
| Number of incidents per device or host | Are some devices or hosts more prone to false positives? |
| Number of incidents per service or application | Are specific services or applications more prone to security issues, causing increased security risk? |
| Number of incidents per account | Are specific accounts (users) more likely to perform risky behavior? |
| Number of analysts assigned | Can incident response resources be allocated more efficiently? |
| Average time of the incident phases | Are there any potential improvements to the escalation process that can make security incident handling more efficient? |
| Incident sources | How often does incident discovery happen manually by an analyst before a received event from a specific technology? |
How SIEM helps you track security KPIs
A SIEM gives you the dashboards to track these KPIs with real-time data instead of assembling them manually after the fact. Across the Sumo Logic customer base, SIEM processes more than 1.1 billion events a day, filters them down to roughly 10,000 alerts at the disposition level, where contextual validation and false-positive tuning happen, and then applies correlation to narrow that further to around ten actionable alerts. Without KPI dashboards, a SOC has no way to show anyone what happened to the other billion-plus events.
And with our SOC Analyst Agent, instead of surfacing another alert, it recommends a specific response action aimed at reducing MTTR at the step where most SOCs lose the most time.
Final thought
There will never be a set of correct security KPIs for every organization. The goals and objectives of each company will invariably differ, and an organization’s KPIs should always reflect its individual priorities and circumstances. In other words, your organization’s security KPIs should be a function of your company’s environment and goals.
See how SIEM helps you streamline this. Get a demo.
