Security metrics that boards actually care about

TL;DR: Boards don't need more security data; they need fewer numbers with more meaning. The metrics that earn a place in the deck share three traits: they connect to business risk, they trend over time against a target, and the CISO can explain — in one sentence — what decision each one informs. Everything else is operations.

What makes a metric board-grade?

Three tests. Decision relevance: if the number moved sharply, would the board do anything differently? If not, it's operational telemetry. Trend and target: a point-in-time number ("14,000 vulnerabilities") is noise; a trajectory against a stated goal ("critical patch latency down from 30 to 12 days against a 7-day target") is governance. Honesty under stress: a metric that can only ever look good — blocked attacks, phishing emails filtered — will eventually be contradicted by an incident, and its owner's credibility goes with it.

Which metrics consistently work?

Five families recur in board decks that survive contact with reality:

Response speed. Mean/median time to detect and time to contain, measured against your own baseline and drilled via exercises when real incidents are (happily) scarce. This is the closest thing security has to a single performance number.

Exposure closure. Time-to-remediate critical vulnerabilities scoped to crown-jewel systems — the scoping is what turns scanner exhaust into a risk statement. Include internet-facing exposure separately: what's reachable from outside, and how fast new exposure gets found and closed.

Identity hygiene. MFA coverage (with the denominator stated honestly), privileged accounts under management, dormant-account closure time. Identity is the top of most real kill chains; boards understand percentages of people.

Third-party posture. Share of critical vendors assessed, high-risk findings open past SLA, concentration risks. Increasingly asked about unprompted, especially post-DORA and NIS2 in Europe.

Program maturity. Framework score (NIST CSF being the common language), current vs. target, with the investment attached to the gap. This is the metric that carries the budget conversation.

What should stay out of the board deck?

Volumes without denominators (alerts triaged, attacks blocked, emails filtered — impressive, meaningless). Tool coverage stats disconnected from risk. Phishing click rates presented as a security outcome rather than an awareness signal. And anything the CISO cannot defend under one skeptical follow-up question — the board deck is under oath in a way a dashboard isn't.

How should a CISO handle a bad quarter?

Lead with it. A metric that worsened, explained with cause and corrective action, builds more standing than a page of greens — and it inoculates the program for the day a real incident tests every previously reported number. The pattern to avoid is silent redefinition: quietly changing a metric's scope to improve it is the kind of thing audit committees are professionally built to notice, and only ever notice once.