A traditional metric quantifies the effectiveness of existing cybersecurity controls using clear, retrospective indicators. Common measures include detected security incidents, time to detect, and time to respond. Tracking these values over time helps teams assess current security posture and communicate measurable program results. section 1.3 section 1.8
Traditional metrics are useful for monitoring control performance, but they require careful interpretation:
- A declining time to detect can indicate improved detection capability. section 1.3
- Incident counts and response times provide tangible data that can be tracked over time. section 1.3
- Reactive measures may miss insider threats, multistage attacks, and weaknesses that have not yet produced an incident. section 1.3 section 10.1
- Pairing them with innovative metrics, threat intelligence, behavioral analysis, or predictive analytics provides a more forward-looking view. section 1.3 section 10.0
Interpreting a detection-time trend
A security program compares its average time to detect incidents across reporting periods. If the measure decreases, the organization can report improved detection capability; it should still avoid treating the result as a complete view of risk because undetected or emerging attack patterns remain outside the measure. section 1.3 section 10.1
