Cybersecurity incident count measures how many security incidents are detected during a defined period. Tracking it over time reveals trends in incident volume and helps assess changes in organizational risk. section 5.3.2 section 9.4.6
A higher count does not automatically mean security has worsened. More sensitive monitoring can uncover incidents that previously went undetected, so interpret counts alongside detection and response measures. section 7.3.5 section 9.4.7
Reading a change in weekly detections
SecureNet increased detections from 10 to 15 incidents per week after improving monitoring. The increase indicated broader detection, not necessarily greater risk; detection time also fell from 45 to 30 minutes. section 9.4.7
Figure 9.3 The left side shows the SecureNet Inc. incident management dashboard before implementing the enhanced IRP and introducing the 10-step IRP framework. The right side illustrates the situation after implementing the plan and introducing the framework.
Compare SecureNet’s incident-management dashboard before and after its response improvements; read the increased count alongside faster detection and identification. section 9.4.7
