Security Performance Metrics Fall Short

promotion


For Voice of Security 2025, sponsored by Tines and AWS, IDC surveyed 900+ security leaders.


In the face of mounting pressures, a new challenge has emerged for security teams - the metrics used to measure their performance often fall short. That’s one of the key findings from IDC's Voice of Security 2025 white paper, sponsored by Tines and AWS, which shows that many organizations use metrics that fail to accurately reflect security team effectiveness.

The survey of 915 security leaders across the US, Europe, and Australia revealed a concerning trend:

  • 35% of security teams are measured by "number of incidents handled" - worryingly, this was the most common metric used
  • 23% are measured by "number of alerts"

These metrics are not just inaccurate, they can threaten to distract and derail security teams looking to measure and improve their performance. It’s akin to judging a doctor’s performance by the number of patients that seek treatment - a factor largely outside their control.

The research highlights an increasing need for security leaders to align with leadership on metrics that accurately reflect security effectiveness by measuring their contribution to organizational resilience and business growth.

The problem: conflating activity with effectiveness

It's clear that metrics like "number of incidents handled" and "number of alerts" offer minimal insights into a security team's effectiveness. While they may be useful for understanding the threat landscape, they shouldn't be used to measure performance. Consider how challenging it would be for a team to establish what "good" looks like - is there an "ideal" number of incidents or alerts to handle? Such metrics can be a burden for already-oversubscribed practitioners.

Worse still, flawed performance metrics can inadvertently undermine team morale and maybe even effectiveness. The IDC research also reveals a strong connection between misaligned metrics and job satisfaction: among security leaders reporting low job satisfaction, the top contributing factor was a "lack of respect and support from other leaders at the organizations."

The solution: selecting metrics that link to resilience

Encouragingly, the research also showed that more meaningful metrics are also being used to track performance:

  • Mean time to respond (32%)
  • Time to detect (32%)
  • Time to containment (28%)
  • Reduction of false positives (22%)
  • Time to eradication (23%)

These metrics offer a more nuanced view of a team's effectiveness, focusing on speed, accuracy, and impact rather than incident or alert volume. They provide insights into how quickly teams can identify, contain, and resolve threats – all factors that directly contribute to an organization's resilience.

By prioritizing these types of metrics, organizations can better understand their effectiveness and make better-informed decisions about resource allocation and strategy. And aligning these metrics with broader business goals can help bridge the gap between security teams and organizational leadership, fostering greater support and recognition for security initiatives.

Four ways to align security metrics with business goals

To bridge the gap between security work and business outcomes, security leaders can:

1.    Prioritize resilience-focused metrics. Collaborate with leadership and security team members to transition from traditional volume-based metrics to those that demonstrate long-term impact and effectiveness.

2.    Align with key business objectives. Directly link security performance to critical business goals such as risk reduction, operational resilience, system uptime, customer trust, regulatory compliance, and profitability (through prevention of costly security incidents).

3.    Quantify security's ROI. Develop a security performance dashboard featuring a "security ROI" metric, providing a clear, data-driven reference point for C-suite discussions.

4.    Promote cross-organizational alignment. Engage with stakeholders across all levels of the organization to gain buy-in for your new metrics framework, clearly demonstrating security's direct contribution to overall business success.

While the most impactful performance metrics will vary by team, every security organization can benefit from rethinking metrics that waste resources or fail to demonstrate true value. By focusing on measures that reflect contributions to organizational resilience, security leaders can better showcase their value and gain crucial support from other business units.


For more insights on how security leaders are tackling their top challenges in 2025, read IDC's white paper.


 


 

 

 

 

« Dior’s Client Data Has Been Breached
Police Investigate Fake Council Tax Fraud »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

ITQ

ITQ

ITQ is an IT consulting firm with a focus on the entire VMware-product portfolio with three main services: Professional Services, Support Services and Managed Services.

Tech Industry Forum (TIF)

Tech Industry Forum (TIF)

Tech Industry Forum is a not-for-profit, membership driven trade body. We bring together end users and some of the UK’s leading cloud, software, platform, infrastructure, and service providers.

Infiltrate

Infiltrate

INFILTRATE is a deep technical conference that focuses entirely on offensive security issues.

Mixed Mode

Mixed Mode

Mixed Mode is a specialist in embedded and software engineering for applications including IoT and secure embedded systems.

CryptoCodex

CryptoCodex

Cryptocodex has developed Counter-Fight, the most advanced, yet simple to implement, counterfeit detection system.

Cansure

Cansure

Cansure is a leading insurance provider in Canada offering a broad range of property & casualty insurance solutions including Cyber & Data Breach insurance.

CERT Tonga

CERT Tonga

CERT Tonga is the national Computer Emergency Response Team for Tonga.

Wise-Mon

Wise-Mon

Wise-Mon is expert in its field of network monitoring and control. We give solutions to huge organizations with tens of thousands of ports, as well as small companies with one switch.

Cytenna

Cytenna

Cytenna Signal is a suite of SaaS (Software-as-a-Service) products that use AI and machine learning to automatically aggregate the latest information about software vulnerabilities.

Anthony Timbers LLC

Anthony Timbers LLC

Anthony Timbers is a cybersecurity consulting and penetration testing firm providing services to the Federal and Commercial sectors nationwide.

Lavabit

Lavabit

Lavabit's Dark Internet Mail Environment is a secure, open-source, secure end-to-end communications platform for asynchronous messaging across the internet.

Verichains

Verichains

Verichains Lab is a pioneer and leading APAC blockchain security firm with extensive expertise in the areas of security, cryptography and core blockchain technology.

Laneden

Laneden

Laneden specialise in helping organisations identify security concerns and quantify the risks you may have across your assets, using Penetration Testing, Threat Simulation and Compliance Testing.

Aardwolf Security

Aardwolf Security

Aardwolf Security specialise in penetration testing to the highest standards set out by OWASP. We ensure complete client satisfaction and aftercare.

Ever Nimble

Ever Nimble

Ever Nimble are award-winning experts in IT support, cybersecurity, and cloud technology. Our proactive approach will enhance your security and protect you from cyber security threats.

Invisinet Technologies

Invisinet Technologies

Invisinet is a cybersecurity technology company specializing in innovative solutions that protect network infrastructure and critical assets from advanced threats.