Metrics that Matter.Confidence & Resilience in Your Security Program
summary
Focuses on concrete measures: break out mean time to resolve from mean time to respond and track false positives versus true positives and anomalous safe counts; measure detection breadth with log‑source coverage and MITRE technique coverage; normalize vulnerability count per host and enforce patch windows (critical <30 days); treat phishing rates as the primary user‑facing metric; demand resilience metrics like mean time to recover and verify 98% endpoint coverage for critical controls.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:54Security metrics challenges
- 8:14Board and executive questions
- 14:58Operational security practices
- 17:13CMMC compliance overview
- 21:12Testing people processes and tech
- 25:06OPSEC and email security
- 30:01Vulnerability management metrics
- 31:26Remote SOC operations
- 36:00Phishing metrics and training
- 39:31Maturity frameworks
- 44:11Red team prioritization
- 47:44Key metrics summary
related talks
42mThe Fault in Our Metrics: Rethinking How We Measure Detection & Response
35mMetrics That Matter: How to Choose Cloud Security KPIs for Your Business
40mCybersecurity Metrics Development for Board and Risk Committee Reporting
55mBenchmarking Threat Resilience Metrics aka How Do We Compare to Our Peers?
25mSecurity Metrics: Protecting Our Digital Assets of the Future
26mWhat (Actually, Measurably) Makes a Security Program More Successful?
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
59mKeynote: Measure Security Effectively