5 Core Elements of a Risk-Based Cybersecurity Dashboard

Curated cyber risk reports are essential to ensuring that security performance management information gets communicated effectively to the right stakeholders across your organization. Of course, reporting falls on a long list of ever-evolving responsibilities for security and risk managers.

By creating dashboards as a continuous reference tool, it’s easier than ever for you to ensure your entire team is aligned on the latest insights regarding your organization’s cyber risk exposure and security program performance over time. 

Here are the five types of metrics you should incorporate into your cybersecurity dashboard:

1. Security ratings

Based on objective, verifiable information, security ratings are a data-driven and dynamic measurement of your organization’s cybersecurity performance. As ratings are updated on a daily basis, this metric empowers your whole team to have a snapshot of your real-time security posture — and how it’s changing over time. Proven to correlate to the likelihood of a breach, BitSight Security Ratings make it easier than ever for you to quantify risk in terms that make sense to the business. For maximum impact, you can add an industry average or pretext goal to this rating as additional context.

2. Risk vector grades

There are a variety of different risk vectors that comprise a security rating. In the BitSight platform, these risk vectors are broken down into four categories — compromised systems, diligence, user behavior, and public disclosures. By incorporating these grades for specific risk vectors into your cybersecurity dashboard, you can empower your team to easily identify any areas of disproportionate risk that need to be addressed. For instance, if you discover that your organization has a low grade in the Desktop Software risk vector, you’d want to allocate the necessary resources to remediate this issue quickly — as any grade below an “A” indicates that your organization is at least 3x more likely to suffer a breach.

3. Mean time to detect

Mean time to detect (MTTD) highlights the average amount of time it takes a security team to become aware of a potential incident. In our current cybersecurity climate, where the security operations center (SOC) is being inundated with alerts, having this visibility is more important than ever. According to a 2018 Imperva survey, 55% of IT professionals receive more than 10,000 threats daily — while 27% receive more than one million. By including MTTD in your cybersecurity dashboard, you can empower your team to align on the current effectiveness of your SOC and how to improve over time in an effort to prevent threat actors from gaining access to your data and systems.

4. Mean time to resolve

In a similar vein to MTTD, mean time to resolve (MTTR) highlights how long it takes the SOC to remediate a threat after it’s been discovered. By understanding this metric, your executive team can make more informed, data-driven resourcing decisions. If, for example, your MTTR is increasing, that should be an immediate red flag that more budget or headcount needs to be allocated to the SOC to prevent a potential security incident or breach.

5. Security awareness training metrics

In our “new normal” operating environment — where more people are working remotely than ever before — it’s increasingly critical that employees are regularly participating in updated security training initiatives. From a dashboard perspective, it could be useful to include two types of metrics here. Firstly, the security awareness training completion rate can help indicate to the executive team how much human-related error their organization could potentially face on a day-to-day basis. And secondly, the average security awareness training score can highlight whether the investment in these initiatives is actually paying off, in turn helping to make more informed decisions on if and when the training program needs to be revamped to achieve better results. 

The ultimate tool for continuous reporting

By equipping stakeholders with a dashboard as a continuous reference tool, you can empower the whole team to make data-driven decisions that more closely consider actual conditions in the cybersecurity department.

Interested in more tips and tricks for optimizing the reporting process across your organization? Check out our ebook, A Practical Guide to Risk-Based Cybersecurity Reporting.