Which of the following is the BEST indicator for measuring performance when implementing DevSecOps in an enterprise?

Mean time to repair (MTTR) is a good operational metric, but it measures *response to failure* rather than the proactive integration and prevention focus of DevSecOps.

A high percentage of automated tests, particularly those encompassing security testing (e.g., SAST, DAST, dependency scanning), is a strong indicator of DevSecOps maturity. It shows that security and quality checks are integrated early and continuously into the CI/CD pipeline, enabling rapid feedback on vulnerabilities and defects without slowing down development or deployment cycles, a core tenet of DevSecOps.

Deployments per day measures agility and throughput, which is important for DevOps, but it doesn't specifically reflect the *security* aspect or the quality achieved through continuous testing inherent in DevSecOps.

Number of defects released per day is an outcome metric reflecting quality, but it's a lagging indicator. The *percentage of automated tests* is a leading indicator of the processes in place to *prevent* defects and security issues from being released, which is central to DevSecOps.