Based on objective, verifiable information, security ratings are a data-driven and dynamic measurement of your organization’s cybersecurity performance. As ratings are updated on a daily basis, this metric empowers your whole team to have a snapshot of your real-time security posture — and how it’s changing over time. Proven to correlate to the likelihood of a breach, BitSight Security Ratings make it easier than ever for you to quantify risk in terms that make sense to the business. For maximum impact, you can add an industry average or pretext goal to this rating as additional context.
Mean time to detect (MTTD) highlights the average amount of time it takes a security team to become aware of a potential incident. In our current cybersecurity climate, where the security operations center (SOC) is being inundated with alerts, having this visibility is more important than ever. According to a 2018 Imperva survey, 55% of IT professionals receive more than 10,000 threats daily — while 27% receive more than one million. By including MTTD in your cybersecurity dashboard, you can empower your team to align on the current effectiveness of your SOC and how to improve over time in an effort to prevent threat actors from gaining access to your data and systems.
In a similar vein to MTTD, mean time to resolve (MTTR) highlights how long it takes the SOC to remediate a threat after it’s been discovered. By understanding this metric, your executive team can make more informed, data-driven resourcing decisions. If, for example, your MTTR is increasing, that should be an immediate red flag that more budget or headcount needs to be allocated to the SOC to prevent a potential security incident or breach.
In our “new normal” operating environment — where more people are working remotely than ever before — it’s increasingly critical that employees are regularly participating in updated security training initiatives. From a dashboard perspective, it could be useful to include two types of metrics here. Firstly, the security awareness training completion rate can help indicate to the executive team how much human-related error their organization could potentially face on a day-to-day basis. And secondly, the average security awareness training score can highlight whether the investment in these initiatives is actually paying off, in turn helping to make more informed decisions on if and when the training program needs to be revamped to achieve better results.
By equipping stakeholders with a dashboard as a continuous reference tool, you can empower the whole team to make data-driven decisions that more closely consider actual conditions in the cybersecurity department.
Interested in more tips and tricks for optimizing the reporting process across your organization? Check out our ebook, A Practical Guide to Risk-Based Cybersecurity Reporting.
If your organization is like many others, its cyber exposure continues to grow over time. During the pandemic, as attackers sought to exploit unprecedented changes in work environments, 35% of cyberattacks used previously unseen malware...
Cybersecurity readiness is the ability to identify, prevent, and respond to cyber threats.
Yet despite the daily headlines and warnings, organizations struggle to achieve cybersecurity readiness. Just look at the statistics: 78% of...
As cyber security threats proliferate, cyber risk conversations are no longer limited to the Security Operations Center (SOC); they command the attention of the C-suite and the boardroom.