Security metrics

A metric earns its place by changing a decision. Everything else is reporting.

Counting things is easy and produces numbers that feel like management. The test is what would happen if the number doubled: if the answer is nothing, it is not a metric worth presenting. Most security dashboards would survive losing eighty per cent of their content without anybody making a worse decision.