Cybersecurity Leaders Highlight Metrics Measuring True Risk Reduction
- Cybersecurity leaders need metrics that show whether their efforts are actually reducing exposure to threats and limiting potential damage rather than just measuring completed tasks, Forbes reported on...
- Security teams can easily quantify their work through common activity metrics like vulnerabilities patched, alerts closed, emails scanned, and employees trained.
- Flavius Plesu of OutThink highlights repeat phishing click rates as an essential indicator of true risk reduction.
Cybersecurity leaders need metrics that show whether their efforts are actually reducing exposure to threats and limiting potential damage rather than just measuring completed tasks, Forbes reported on October 12, 2026.
Tracking Repeat Phishing Click Rates And Attack Paths
Security teams can easily quantify their work through common activity metrics like vulnerabilities patched, alerts closed, emails scanned, and employees trained. However, a growing list of completed tasks does not necessarily mean an organization is becoming more secure.
Flavius Plesu of OutThink highlights repeat phishing click rates as an essential indicator of true risk reduction.
Most people learn fast; after one or two clicks, they stop falling for phishing sims or real attacks. Risk sits with the small group who fall for it every time; they are the ones an attacker actually finds and uses. Watch that group shrink over time, and you are watching real risk go down.
Flavius Plesu, OutThink
Evaluating Attacker Options And Isolation Speeds
Saeed Abbasi of Qualys points out that the true test of effectiveness is how many practical, low-cost options an attacker retains to compromise a crown-jewel asset using public, weaponized exploits. When that number drops, risk drops. Patches shipped, mean time to remediate, alerts closed, and coverage measure defender activity rather than actual attacker difficulty.
Kapil Bareja of Deloitte emphasizes measuring the mean time to identify and isolate a compromised system. Because perfect prevention remains impossible and attackers will eventually breach defenses, the critical factor is how quickly an organization notices, understands what happened, and contains the damage.
Measuring Vulnerability Remediation And Guardrail Violations
Mario Vuksan of ReversingLabs suggests counting releases shipped with a software bill of materials verified against the actual build rather than just generated.
Claude Mandy of Edera advises focusing on intended risk outcomes by tracking how many systems are secure by design, blocking everything by default and allowing only what is strictly needed. Vasanth Mudavatu of Dell Technologies focuses on the percentage of detected vulnerabilities that violate agreed thresholds for severity, exploitability, or remediation time.
Chris Wysopal of Veracode tracks the remediation half-life for critical, exploitable vulnerabilities, separating views for business-critical applications and third-party components.
Assessing Identity Risk And Blast Radius Control
Michael Engle of 1Kosmos tracks how often high-risk identity moments, such as account recovery and password resets, are resolved through verified identity confirming a real and authorized person. Michael Beygelman of Insygna watches how many credentials in an environment have no owner, such as unattached service accounts, API keys, and agent tokens.
Paul Zolfaghari of Saviynt looks for reductions in high-risk or stale access over time by tying excessive permissions and orphaned accounts directly to enterprise risk reduction. Deepak Mittal of CloudKeeper focuses on critical assets exposed to exploitation, while Nitesh Sinha of Sacumen tracks the percentage of crown-jewel assets fully hardened with multifactor authentication, encryption, and strict network segmentation.
Dr. Aditya Vikram Kashyap of Morgan Stanley recommends tracking blast radius rather than activity, ensuring that a compromised identity or device reaches fewer critical systems than it could in the previous quarter. Mike Britton of Abnormal AI tracks time-to-detection on novel attacks, and Dr. TJ Jiang of AvePoint focuses on the time required to identify, prioritize, and remediate critical risks.
David Etue of Cyberbit concludes the evaluation framework by tracking defended attack-path coverage, mapping likely attack paths to crown-jewel assets, and verifying telemetry, controls, and tested responses.