“Metrics are – fundamentally – a communications tool, potentially very powerful in evaluating the maturity of an organisation’s security culture,” said Barbara Filkins, survey author and Director of Research, SANS Analyst Program. “Regulatory frameworks are a starting point, but organisations need to look beyond a ‘cookie cutter’ approach and evaluate what needs to be measured to identify and mitigate business risk. Survey results were refreshing – supporting the need for mirroring organizational uniqueness – while providing actionable insight into how to meet the challenge of developing useful measures.”

“One of the top factors common across organisations that avoid major damage from cyber attacks is the use of business-relevant security metrics” said John Pescatore, Director of Emerging Security Trends at SANS and survey advisor. “The survey pointed out that, all too often, the most easily collected security metrics satisfy auditors but have little connection to reducing business risk.”

While the analytics and data science are certainly important to metrics development, the survey concludes that the emphasis is more on educating and training how to implement a metric framework, taking into account how organisations must differ in achieving their goals and objectives for security.