Skip to main content

How We Help

 

Featured

Solutions

 

Who we help

Platform

 

Featured

About Panaseer

 

Featured

Content

 

Featured

Join us for our Metric of the Month series where cybersecurity experts from around the globe put a spotlight on their favourite security metrics. We’ll help you understand the importance of key metrics as well as how and why you should be measuring them

FEBRUARY 2023

Metric of the Month: Three measurement essentials for reporting cybersecurity to the board

Cybersecurity is now a key focus in the boardroom. So, if you want to improve how you report cybersecurity posture to your board, wouldn’t it be great to get advice from one of the world’s leading technology companies? Well, look no further. For this edition of Metric of the Month, we spoke to Pam Lindemoen, CISO Advisor at Cisco.

“I advise CISOs to tell your story at the board level. You can’t just show your metrics. You’ve got to articulate how effective your controls are, which could take the form of two or three scenarios from your previous quarter that demonstrate what you’ve seen in your environment and how effectively your control stack is operating.”

Pam Lindemoen is a CISO Advisor at Cisco. She spends her days helping security leaders, with particular focus on reporting cybersecurity to the board. She has spent over 20 years providing strategic direction and implementation support for the information security and regulatory compliance strategies across multiple industries.

All articles

February 2023

Three measurement essentials for reporting cybersecurity to the board

Cybersecurity is now a key focus in the boardroom, with new regulations like DORA and NIS2 making boards legally accountable for cyber risk. A recent report found that 76% of boards discuss cybersecurity once per month, but also found a disconnect between the CISO’s understanding of their organization’s cybersecurity capability and that of the board. […]

Barnaby Clarke

December 2022

Metric of the Year: 2022’s top cybersecurity metrics

Someone thought it would be fun if I wrote a “12 metrics of Christmas” blog. I got as far as “partridge in a PAM tree” and decided to do this instead. Over the past year, there have been some great contributors for our Metric of the Month series, exploring metrics that have taken us across […]

Barnaby Clarke

September 2022

Four security metrics that prove you’re a good bet for cyber insurance

The cyber insurance saga continues. Premiums are high, coverage is limited, insurers are piling on more scrutiny, and it’s tougher to qualify. To help reduce the pressure, we’re exploring the security metrics and measures that cyber insurers will expect to see. One year you’re filling out a single-page questionnaire and picking up cyber insurance with […]

Jim Doggett | Barnaby Clarke

August 2022

Seven cybersecurity metrics for basic cyber hygiene

The Microsoft Digital Defense Report found that basic cyber hygiene protects against 98% of attacks. We explore crucial areas of cyber hygiene and highlight key supporting metrics. We’re joined by Stuart Aston, National Security Officer at Microsoft UK, and cybersecurity veteran. He’s been in the industry since the late ‘80s and has been making public […]

Stuart Aston | Barnaby Clarke

July 2022

11 metrics to empower your threat modelling programme

Threat modelling is a crucial part of cybersecurity. Not just in terms of tool deployment, but also to help enable a cultural shift towards proactive cybersecurity. This month we’re joined by a leading expert in threat modelling, Adam Shostack. He spends most of his time coaching threat modelling, and has authored several books, such as […]

Adam Shostack | Barnaby Clarke

June 2022

Applying the ‘Goal Question Metric’ method to cybersecurity measurement

The ‘Goal Question Metric’ (GQM) approach is commonly used to improve and measure software quality, but it can also be applied to cybersecurity. James Blake is the co-founder and director of Security B-Sides London, former-CISO at Mimecast and currently Field CISO at Rubrik, and not to mention an expert in cybersecurity measurement. In this article, […]

James Blake | Barnaby Clarke

May 2022

Why security teams need to measure cloud misconfigurations

“Speed over security shouldn’t be a question.” But with cloud configuration, that is often the case. This leads to an important risk that needs to be measured and understood: cloud misconfigurations. For this article, I caught up with “friend of the show” Andreas Wuchner. Andreas is a renowned cyber and risk expert with over 20 […]

Andreas Wuchner | Barnaby Clarke

April 2022

Three steps to improve transparent cybersecurity reporting with coverage metrics

“Cybersecurity coverage metrics are hugely important because they help to make security reporting more trustworthy.” Philippe Korur is an experienced cyber risk consultant at PwC UK, leading the PwC Cyber Risk Reporting Platform. That means there aren’t many better people to talk to about cybersecurity metrics, measurement, and reporting. Philippe joins us to discuss the […]

Philippe Korur | Barnaby Clarke

March 2022

How to measure security vulnerabilities that evade patching

In the complexity of an enterprise vulnerability management programme, vulnerabilities can sometimes evade patching. There are times when you may think you have fixed a vulnerability, but the patch failed for some reason. This is a risk that mature security programmes should be measuring. In this article, we’ll cover: Why should you measure vulnerabilities that […]

Barnaby Clarke

February 2022

Nine essential cybersecurity metrics for the new CISO

What metrics does a new CISO need to measure? When joining a new organisation as a security leader, it’s imperative to prioritise essential cybersecurity metrics. For this Metric of the Month, we spoke to a CISO who will remain anonymous. Suffice to say, he is a well-established cybersecurity leader with 20 years’ experience in financial […]

Barnaby Clarke

January 2022

Blocking user non-compliance: the security metric to stop risky behaviour

Every day, every enterprise organisation must block user non-compliant actions. There are plenty of link clicks, file downloads, and emails sent containing sensitive information. Crucially, though, some of these clicks, downloads, and emails could pose a security threat. The riskiest need to be blocked with defensive tools like firewalls. We’re joined by Shawn Bowen to […]

Shawn Bowen | Barnaby Clarke

December 2021

Metric of the Year: Three crucial security metrics from 2021

Our final Metric of the Month for 2021 is a roundup of the most popular metrics we’ve covered this year, based on page views – a Metric of the Year, if you will.    We’d like to thank all our contributors from the past 12 months, who have given us valuable insight into the metrics […]

Barnaby Clarke

November 2021

Using security metrics to prioritise vulnerabilities

This article is written in collaboration with an information security executive at a Fortune 500 financial services firm. We discuss an approach to vulnerability prioritisation that goes beyond the typical severity index of critical, high, medium, low to create a multi-dimensional model that prioritises systems using various factors such as business context. The challenge of […]

Barnaby Clarke

October 2021

Aligning metrics to security controls frameworks

Security controls frameworks are an essential aspect of any security programme, providing guidelines for the controls an organisation must implement in order to effectively defend themselves. In this Metric of the Month, we explore what makes a good framework, the challenges around compliance, ransomware, automation, and more, as we interview a world-leading expert on security […]

Phyllis Lee | Barnaby Clarke

September 2021

What are the most important application security metrics?

In this article, we look at two important application security metrics to evaluate to ensure the right controls are in place for an organisation’s critical applications – vulnerable code and application access. We welcome back James Doggett, a senior security and technology risk expert who’s seen it all. With decades of experience in senior roles at organisations like EY, JP Morgan, Kaiser Permanente and AIG, Jim’s enterprise security wisdom has been a great source of support. […]

Jim Doggett | Barnaby Clarke

July 2021

Security metrics to help protect against ransomware

Andrew Jaquith walks us through a three-step playbook of ransomware protection metrics to help security teams disrupt the bad guys and reduce the chances of a successful ransomware attack. We’re taking a little detour from our usual deep dive into a single security metric and enlisting the help of Andrew, a seasoned CISO and security metrics expert, […]

Andrew Jaquith | Barnaby Clarke

July 2021

Metric of the Month: On-demand panel discussion

We recently held our first ever LIVE Metric of the Month panel discussion. We welcomed five previous collaborators to return and discuss some of their favourite security metrics, whether because they are particularly interesting, difficult to measure, or especially valuable when it comes to protecting the enterprise. The panelists were: Andreas Wuchner, who spoke about […]

Barnaby Clarke

July 2021

What makes a good security metric?

‘I think everyone who looks into the whole world of risk management will come to the point that it’s all about controls, and how to measure their effectiveness’, said cyber and risk expert Andreas Wuchner in our first live Metric of the Month panel discussion. To put this article into context, that very panel – made up of seasoned CISOs and Metric of the […]

Barnaby Clarke | Andreas Wuchner

June 2021

Five tips for Privileged Access Management metrics

“If a privileged account is accidentally compromised or maliciously used, there is a much greater risk to the organisation. It can lead to data loss, system outage, and more. The risk to your environment, if not managed well, can be catastrophic.” – David Fairman In this instalment of Metric of the Month, we caught up with David Fairman to […]

David Fairman | Barnaby Clarke

May 2021

How to measure mean time to detect and respond metrics

In this instalment of Metric of the Month, we are delighted to welcome Matt Burns as a guest author to talk about ‘mean time to detect and respond’. Matt has over a decade of experience in security and risk, and currently works for the PwC UK Cyber Security Practice as a trusted advisor to boards […]

Matt Burns

April 2021

How do you measure cyber awareness culture?

‘The cyber awareness culture challenge is this: a lot of organisations think that the user is the biggest source of your security problems…

Andreas Wuchner | Barnaby Clarke

March 2021

The fundamental cybersecurity metric: Asset inventory

‘There are so many things you could measure. When you’re running a security programme, you want to use metrics to improve your security, or at least gain …

Raffael Marty | Barnaby Clarke

February 2021

How to prioritise patching with vulnerability outlier analysis

‘Some risks you always have to live with. Eliminating all risks is rarely the goal. My goal is to fix the highest risk items that are the easiest items. There’s …

Jim Doggett | Barnaby Clarke

January 2021

Toxic combinations of privilege in cybersecurity

‘The term ‘toxic combinations’ alludes to pharmacology in the sense that if you put two drugs together, you can kill the patient. In the risk world …

Andrew Jaquith | Barnaby Clarke

December 2020

The challenge of active leavers in cybersecurity

‘In an ideal world, everything would be easy, connected, and simple. HR and IT would be aligned and know all the accounts this person has …

Andreas Wuchner | Barnaby Clarke

November 2020

The importance of automating security controls coverage

Welcome to our new ‘Metric of the Month’ series! In this series, we want to spotlight a range of valuable security metrics and measures, and discuss …

David Fairman | Barnaby Clarke

Sign up to our Metric of the Month newsletter