<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Metrics & Reporting Reference

Deep reference for security KPIs/KRIs, executive dashboards, and risk quantification.
Parent skill: [../SKILL.md](../SKILL.md)

---

## KPI/KRI Catalog by Security Domain

### Operational KPIs (measure efficiency)

| Domain | Metric | Formula | Target | Cadence |
|--------|--------|---------|--------|---------|
| Detection | Mean Time to Detect (MTTD) | Alert timestamp − compromise timestamp | < 24h | Monthly |
| Response | Mean Time to Respond (MTTR) | Containment timestamp − alert timestamp | < 4h | Monthly |
| Response | Mean Time to Recover | Full service restoration − incident start | < 48h | Monthly |
| Vulnerability | Patch SLA compliance | Patches applied within SLA / Total patches due | > 95% critical | Weekly |
| Vulnerability | Mean Time to Remediate | Remediation date − discovery date (by severity) | < 7d critical | Monthly |
| Identity | Privileged access reviews | Reviews completed on time / Total scheduled | 100% | Quarterly |
| Identity | Orphaned accounts | Accounts with no owner / Total privileged accounts | < 2% | Monthly |
| Awareness | Phishing simulation click rate | Clicks / Emails delivered | < 5% | Monthly |
| Awareness | Training completion | Employees completed / Total employees | > 95% | Quarterly |
| Compliance | Audit findings open | Open findings by severity and age | 0 critical > 30d | Monthly |
| Endpoint | EDR coverage | Endpoints with EDR / Total managed endpoints | > 98% | Weekly |
| Network | Segmentation compliance | Segments meeting policy / Total segments | > 95% | Monthly |

### Risk KRIs (measure risk exposure)

| KRI | Description | Threshold | Escalation |
|-----|-------------|-----------|------------|
| Critical vuln exposure days | Days critical vulns remain unpatched | > 7 days | CISO → CTO |
| Failed login anomaly | Spike > 3σ above baseline | Alert | SOC → IR |
| Data exfiltration volume | Outbound data > threshold | > 1 GB/hr to new destination | SOC → IR |
| Third-party risk score | Vendor security rating drop | Below threshold | Vendor manager → CISO |
| Unmanaged device count | Devices on network without agent | > 5% of fleet | IT Ops → CISO |
| Privileged session anomaly | Admin actions outside business hours | Any occurrence | SOC triage |

---

## Executive Dashboard Design Patterns

### Dashboard Hierarchy

```
Level 1: Board / C-Suite       — Risk posture, trend, top 3 risks, budget
Level 2: CISO / VP Security   — Domain scores, SLA compliance, incident summary
Level 3: Security Managers     — Operational metrics, team performance, backlog
Level 4: Analysts / Engineers  — Real-time alerts, queue depth, active incidents
```

### Board Dashboard (Level 1)

Single page. Five elements maximum:

```
┌─────────────────────────────────────────────────────┐
│  SECURITY RISK POSTURE — Q1 2026                    │
├──────────────┬──────────────┬───────────────────────┤
│ Risk Score   │ Trend (6mo)  │ Top 3 Risks           │
│   6.1 / 10   │ ████▓▓▒▒░░  │ 1. Legacy EOL         │
│   ↓ from 7.2 │  improving   │ 2. Vendor gap          │
│              │              │ 3. Cloud misconfig     │
├──────────────┴──────────────┼───────────────────────┤
│ Key Metrics                 │ Budget                 │
│ MTTD: 4h (target: 24h) ✓  │ Spent: $1.2M / $1.5M  │
│ Patch SLA: 97% ✓          │ On track (80%)         │
│ Incidents: 3 (0 critical) │ Ask: $200K for [X]     │
└─────────────────────────────┴───────────────────────┘
```

### Design Principles

1. **Traffic light scoring** — Red/Amber/Green for instant comprehension
2. **Trend over point-in-time** — Always show direction, not just current value
3. **Business context** — Frame metrics as risk/impact, not technical jargon
4. **Actionable** — Every red indicator has a remediation plan referenced
5. **Consistent cadence** — Same format every quarter for comparability

---

## Board Reporting Templates and Cadence

### Reporting Calendar

| Report | Audience | Cadence | Format |
|--------|----------|---------|--------|
| Security posture summary | Board | Quarterly | 2-page brief + 10-min verbal |
| Incident summary | Board (if material) | As needed | 1-page brief |
| Risk register update | Risk committee | Monthly | Spreadsheet + narrative |
| Operational metrics | CISO staff | Weekly | Dashboard |
| Compliance status | Audit committee | Quarterly | Findings tracker |

### Board Report Structure

```
1. EXECUTIVE SUMMARY (3 sentences)
   Current posture, key change since last report, primary recommendation.

2. RISK SCORECARD
   Overall score + domain scores with trend arrows.

3. KEY ACHIEVEMENTS
   Top 3 accomplishments with business impact quantified.

4. ACTIVE RISKS
   Top 3 risks with likelihood, impact, and mitigation status.

5. INCIDENTS
   Summary: count by severity, notable incidents (if any), lessons learned.

6. COMPLIANCE
   Audit status, open findings count by severity and age.

7. BUDGET
   Spend vs. plan, forecast, any asks.

8. NEXT QUARTER PRIORITIES
   Top 3 initiatives with expected outcome.
```

---

## Risk Quantification with FAIR Model

### FAIR Overview

Factor Analysis of Information Risk (FAIR) quantifies risk in financial terms. It replaces qualitative "high/medium/low" with dollar-range estimates.

### FAIR Taxonomy

```
Risk ($)
├── Loss Event Frequency
│   ├── Threat Event Frequency
│   │   ├── Contact Frequency (how often threat contacts asset)
│   │   └── Probability of Action (will threat act?)
│   └── Vulnerability (probability of success given action)
│       ├── Threat Capability
│       └── Control Strength
└── Loss Magnitude
    ├── Primary Loss
    │   ├── Productivity loss
    │   ├── Response cost
    │   ├── Replacement cost
    │   └── Competitive advantage loss
    └── Secondary Loss
        ├── Regulatory fines
        ├── Reputation damage
        └── Litigation cost
```

### FAIR Analysis Example

**Scenario:** Ransomware encrypts production database.

| Factor | Estimate | Basis |
|--------|----------|-------|
| Threat Event Frequency | 4/year | Industry reports, threat intel |
| Vulnerability | 30% | Current controls (EDR, backups, patching) |
| Loss Event Frequency | 1.2/year | TEF × Vulnerability |
| Primary Loss (per event) | $500K–$2M | Recovery cost, downtime, ransom |
| Secondary Loss (per event) | $1M–$5M | Regulatory, reputation, legal |
| Annualized Loss Expectancy | $1.8M–$8.4M | LEF × (Primary + Secondary) |

### Communicating FAIR Results

```
"Based on FAIR analysis, our annualized ransomware risk is $1.8M–$8.4M.
Investing $400K in [immutable backups + EDR upgrade] reduces vulnerability
from 30% to 10%, lowering ALE to $600K–$2.8M — a 3:1 to 6:1 ROI."
```

### Tools

| Tool | Description |
|------|-------------|
| FAIR-U | Free web-based FAIR calculator (RiskLens) |
| RiskLens | Enterprise FAIR platform |
| Open FAIR | Open Group standard documentation |
| Monte Carlo simulation | Custom Python/R for range estimation |
