Purpose
A metric is useful when it helps someone decide, investigate, prioritize, allocate resources, verify a control, or recognize changing risk.
Common weak measures
Counts of alerts, vulnerabilities, training completions, or blocked events can describe activity without explaining consequence, coverage, quality, or whether risk changed.
Stronger questions
- What important assets and pathways are covered?
- How much exploitable exposure remains and for how long?
- Which controls fail, drift, or produce weak evidence?
- How quickly can the organization detect, contain, and recover?
- Which investment changes expected loss, operational resilience, or decision confidence?
Preserve context
Every metric needs a definition, owner, source, calculation, limitation, target audience, and decision use. Trend changes should be investigated before they are celebrated or blamed.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: