A useful security number helps someone decide whether important work is happening or a control is improving. A large total of alerts, scans, or training invitations may look active without explaining the result. Start with the decision you want the measure to support.
Understand the idea
Define the population, calculation, source, owner, and period. For example, patch coverage needs a reliable list of in-scope devices and a definition of “up to date.” Include exceptions and data gaps. A percentage without a clear denominator can conceal missing systems.
- Population
Define what systems, identities, or events are in scope.
- Measure
Connect the number to a control or operational decision.
- Interpret
Review changes, exceptions, and the underlying evidence.
A practical example
Imagine a dashboard reporting that 95% of devices are patched. Review shows it counts only devices that checked in recently, leaving offline laptops out. The team changes the measure to show the full managed population, unknown states, and actions assigned to overdue devices.
What to do next
- Name the decision. Choose a measure because someone needs to decide or improve something, not simply because a dashboard offers it.
- Define the calculation. State the full population, data source, period, owner, and meaning of the result.
- Show gaps and exceptions. Keep unknown devices, missing records, and approved exceptions visible instead of silently removing them from the count.
- Check a sample. Recalculate from the underlying evidence and confirm that changes between periods have a sensible explanation.
How to check the result
Recalculate a sample from the underlying records and explain a change between periods. Keep a small set of measures that connect to decisions rather than adding numbers simply because a tool provides them.
We closed more tickets this month. Did risk fall?
Not necessarily. Check whether important exposure was removed and the fixes were verified. Closure volume can rise while the most consequential issues remain unresolved.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
