What is an example of a key performance indicator for cybersecurity?

Question

Options

• APercentage of product defects that negatively impact the security posture of the system
• BYear over year comparison of organizational cybersecurity incidents
• CMean the to repair (MTTR)
• DNetFlow data

• A
  16% (5)
• B
  71% (22)
• C
  3% (1)
• D
  10% (3)

Explanation

Option B is correct because a Key Performance Indicator (KPI) measures progress toward a strategic organizational goal over time - year-over-year incident comparison directly tracks whether the organization's security program is improving, staying flat, or deteriorating, making it a true performance metric.

Why the distractors are wrong:

• A (product defects affecting security posture) is more of a quality assurance or development metric - it measures a process output, not the overall security performance of the organization.
• C (MTTR) is a solid operational metric, but it's typically classified as a Key Risk Indicator (KRI) or operational metric rather than a KPI - it measures response efficiency, not strategic security performance trends.
• D (NetFlow data) is raw network telemetry used for traffic analysis and threat detection - it's an input to security monitoring, not a performance indicator at all.

Memory tip: Think of KPIs as answering "Are we getting better?" - year-over-year incident trends answer exactly that. If a metric just describes current state or raw data (NetFlow), measures a single event (MTTR), or tracks a subprocess (defects), it's not a KPI.

No community discussion yet for this question.