Security Performance Metrics Fall Short

Uploaded on 2025-05-01 in FREE TO VIEW

promotion

For Voice of Security 2025, sponsored by Tines and AWS, IDC surveyed 900+ security leaders.

In the face of mounting pressures, a new challenge has emerged for security teams - the metrics used to measure their performance often fall short. That’s one of the key findings from IDC's Voice of Security 2025 white paper, sponsored by Tines and AWS, which shows that many organizations use metrics that fail to accurately reflect security team effectiveness.

The survey of 915 security leaders across the US, Europe, and Australia revealed a concerning trend:

35% of security teams are measured by "number of incidents handled" - worryingly, this was the most common metric used

23% are measured by "number of alerts"

These metrics are not just inaccurate, they can threaten to distract and derail security teams looking to measure and improve their performance. It’s akin to judging a doctor’s performance by the number of patients that seek treatment - a factor largely outside their control.

The research highlights an increasing need for security leaders to align with leadership on metrics that accurately reflect security effectiveness by measuring their contribution to organizational resilience and business growth.

The problem: conflating activity with effectiveness

It's clear that metrics like "number of incidents handled" and "number of alerts" offer minimal insights into a security team's effectiveness. While they may be useful for understanding the threat landscape, they shouldn't be used to measure performance. Consider how challenging it would be for a team to establish what "good" looks like - is there an "ideal" number of incidents or alerts to handle? Such metrics can be a burden for already-oversubscribed practitioners.

Worse still, flawed performance metrics can inadvertently undermine team morale and maybe even effectiveness. The IDC research also reveals a strong connection between misaligned metrics and job satisfaction: among security leaders reporting low job satisfaction, the top contributing factor was a "lack of respect and support from other leaders at the organizations."

The solution: selecting metrics that link to resilience

Encouragingly, the research also showed that more meaningful metrics are also being used to track performance:

Mean time to respond (32%)
Time to detect (32%)
Time to containment (28%)
Reduction of false positives (22%)
Time to eradication (23%)

These metrics offer a more nuanced view of a team's effectiveness, focusing on speed, accuracy, and impact rather than incident or alert volume. They provide insights into how quickly teams can identify, contain, and resolve threats – all factors that directly contribute to an organization's resilience.

By prioritizing these types of metrics, organizations can better understand their effectiveness and make better-informed decisions about resource allocation and strategy. And aligning these metrics with broader business goals can help bridge the gap between security teams and organizational leadership, fostering greater support and recognition for security initiatives.

Four ways to align security metrics with business goals

To bridge the gap between security work and business outcomes, security leaders can:

1. Prioritize resilience-focused metrics. Collaborate with leadership and security team members to transition from traditional volume-based metrics to those that demonstrate long-term impact and effectiveness.

2. Align with key business objectives. Directly link security performance to critical business goals such as risk reduction, operational resilience, system uptime, customer trust, regulatory compliance, and profitability (through prevention of costly security incidents).

3. Quantify security's ROI. Develop a security performance dashboard featuring a "security ROI" metric, providing a clear, data-driven reference point for C-suite discussions.

4. Promote cross-organizational alignment. Engage with stakeholders across all levels of the organization to gain buy-in for your new metrics framework, clearly demonstrating security's direct contribution to overall business success.

While the most impactful performance metrics will vary by team, every security organization can benefit from rethinking metrics that waste resources or fail to demonstrate true value. By focusing on measures that reflect contributions to organizational resilience, security leaders can better showcase their value and gain crucial support from other business units.