Security metrics and reporting
You build the path from goals to metrics, define KPIs and KRIs, collect data from CSV sources and produce automated reports and management dashboards with trends and targets.
Level 301 · 16 lessons · 15 practice labs
Lessons
Metric design
- Why we measure: metrics for decisions
- The goal–question–metric method
- KPIs, KRIs and control indicators
- The metric definition card: formula, source, owner
- Quick task: five metric cards
Data
- Collecting metric data
- Setting targets and thresholds
- Trend analysis
- Vanity metrics and wrong incentives
- Quick task: calculate patching metrics
Reporting
- Reports by audience: operations, management, board
- Maturity scorecards
- Generating an automated monthly report
- Quick task: one page for the board
Finish
- Reviewing metrics every year
- Capstone: a one-year security metrics programme
Practice labs
- KPI, KRI or control indicator: Classify fifteen metrics as performance, risk or control indicators.
- Build a goal–question–metric tree: Write a tree with two questions for each of three security goals and the metrics that answer each question.
- Write five metric cards: Write five metric cards with formula, source, frequency, owner and threshold for patching, access, incidents, training and suppliers.
- Calculate patching metrics: From a patching export, calculate the share of vulnerabilities fixed on time and the mean time to fix.
- Clean dirty data and measure: Clean an export with duplicate rows and wrong dates, recalculate three metrics and explain the difference.
- Automate the metric calculation with a script: Prepare a re-runnable script that calculates five metrics from three export files and writes them as a table.
- Weed out the vanity metrics: Mark the vanity metrics among fifteen that change no decision and propose an alternative for each.
- Set targets and thresholds: Set target, warning and critical thresholds for six metrics from past data and risk appetite.
- Read the trend and spot the wrong incentive: In twelve months of data, separate real improvement from seasonality and report two patterns that suggest a metric is being gamed.
- Match the metric to its audience: Place twenty metrics in the operations, management or board report.
- One page for the board: From a quarter's metric data, write a one-page board report with three messages, the trend and one decision request.
- Prepare a maturity scorecard: From assessment notes on eight domains, prepare a scorecard of current and target level and explain the three largest gaps.
- Review the metric inventory: In a twenty-metric inventory, mark those with no owner, no data feed or no use in a year.
- Generate the monthly report from a template: Pour the prepared metric table into the template to generate the monthly report with status colours and short commentary.
- A one-year metrics programme: Write a programme document for Ilgıntepe Tekstil with the metric set, data sources, reporting calendar and yearly review steps.
About this course
You build the path from goals to metrics, define KPIs and KRIs, collect data from CSV sources and produce automated reports and management dashboards with trends and targets.
What you will learn
- Metric design
- Data
- Reporting
- Finish
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.