What cybersecurity KPIs are and which metrics truly measure protection: MTTD, MTTR, containment time, false-positive rate. Benchmarks and formulas.
Cybersecurity KPIs are the metrics by which a business evaluates how effectively its information protection works. The main problem of most companies is not that they "measure nothing," but that they measure the wrong things: the number of closed tickets, the number of installed antivirus agents, or the volume of traffic passed through a firewall. These numbers describe activity, but they don't answer the one question the business owner cares about: has security actually gotten better? In this article we break down which metrics are worth tracking, how to calculate them, and what values to aim for, based on real data from CrowdStrike, IBM, and Ponemon Institute reports.
What cybersecurity KPIs are and why you should measure them
A Key Performance Indicator (KPI) is a measurable value that shows how close a company is to its goal. In the context of information protection, KPIs answer "how protected are we," not "how much did we do." This is the fundamental difference between outcome metrics and activity metrics.
A classic example of substitution: a security team reports that it closed 500 tickets in a month and installed antivirus on 98% of devices. It sounds convincing, but it says nothing about whether the system detects real attacks in time and responds quickly. The IBM Cost of a Data Breach report shows why this matters: the average time organizations take to detect and contain a data breach is still measured in days and months, not hours.
Besides KPIs, two other types of metrics are used in risk management. Metrics are raw measurements (number of events, traffic volume) that are neither good nor bad by themselves. Key Risk Indicators (KRI) are early signals that risk is growing: for example, a rising number of vulnerabilities past their patch deadline. A KPI closes the chain: a metric shows the fact, a KRI warns, and a KPI assesses progress toward the goal.
Why measure cybersecurity KPIs at all? First, to allocate budget sensibly: when you see that response time isn't shrinking, it's clear where to invest — in automation or in people. Second, to speak with leadership in one language — the language of risk and money, not technical terms. And third, to avoid living in an illusion of security: without measurements, you can't tell whether protection is improving or standing still.
The two main metrics: MTTD and MTTR
If you had to keep only two KPIs out of the whole variety, take these. Together they describe the most important thing — the speed of your defensive reaction.
MTTD (Mean Time to Detect) is the average time from the appearance of a threat to the moment the team detects it. The formula is simple: the sum of "detection time minus event time" across all incidents, divided by the number of incidents. This metric measures monitoring effectiveness: how well detection rules are tuned, whether system coverage is complete, and whether analysts suffer from "alert fatigue," when important events get lost in the noise.
MTTR (Mean Time to Respond) is the average time from detecting an incident to resolving it. Here you should be careful: the MTTR acronym means different things in the industry depending on the vendor — Respond, Remediate, Repair, or Resolve (ticket closure). Because of this, comparing "MTTR" across reports without clarifying the definition is one of the most common mistakes. For security teams it most often means Respond or Resolve: how long from confirming the attack to fully closing it.
Why speed is so critical is vividly shown by the CrowdStrike Global Threat Report 2025. The average "breakout time" — the interval from an attacker's initial intrusion to the start of lateral movement — dropped to a record 48 minutes (a year earlier it was 62 minutes), and the fastest recorded breakout took just 51 seconds. This means defenders sometimes have less than a minute to notice and react to an attack before the attacker digs in deeper. The same report notes that 79% of detections were "fileless" (malware-free) — meaning classic antivirus that hunts for malicious files simply won't see such scenarios.
Benchmarks for security teams: MTTD under 24 hours and MTTR under 4 hours are considered reasonable targets for a mature SOC. If your metrics are substantially higher, that's a signal of detection problems or a lack of response automation.
Containment time, dwell time, and response speed
Besides MTTD and MTTR, there are several derived metrics that refine the picture.
MTTC (Mean Time to Contain) is the time from detection to isolating the threat — the moment the attack is stopped and its spread across the network halted. For critical incidents the benchmark is under 1 hour: ransomware can encrypt an entire network in 45 minutes, so every second counts.
Dwell time is how long an attacker remains inside the system undetected. It consists of detection time plus containment time. The target for mature teams is under 21 days, though industry averages remain far worse.
The scale of the problem at a global level is shown by the IBM Cost of a Data Breach 2025 report. The average time to detect and contain a data breach dropped to 241 days — a nine-year low and a continuation of the trend after the peak of 287 days in 2021. Of that, 181 days go to detection and 60 days to containment. The same report captures the impact of automation: organizations that actively use AI and automation in security cut response time by 80 days and reduced the average breach cost by 1.9 million dollars.
A separate metric worth tracking is alert investigation coverage. According to the Ponemon Institute, on industry average only 38% of security alerts are investigated — meaning six out of ten alerts are never reviewed at all. This is a direct measure of a team's operational capacity: if coverage is low, you have blind spots through which real attacks pass unnoticed.
Security hygiene KPIs: patching, coverage, and staff training
Response speed is already fighting the consequences. But there's a group of metrics that measure how well you prevent attacks in advance.
Patching cadence — how much time passes from the release of a fix for a critical vulnerability to its deployment. This is one of the cheapest ways to close risk: attackers actively scan networks for unpatched systems right after exploits are published. Track the percentage of critical vulnerabilities closed within 30 days.
Protection coverage — the percentage of devices, servers, and cloud resources running EDR/antivirus and connected to monitoring. Any uncovered device is a potential entry point. Track here the number of "unknown" devices on the network that haven't gone through inventory.
False positive rate — the share of alerts that turned out to be false. The benchmark is under 30%: below 20% is considered excellent, 40–60% leads to "alert fatigue," when analysts stop trusting the system and start ignoring notifications. Over 60% is a signal that detection rules need serious tuning.
Phishing simulation click rate — the percentage of employees who clicked a training phishing link. This is a leading indicator of the human factor: the lower it is, the lower the risk that social engineering will succeed. Security training completion rate is another human-risk metric; the target is 95% or higher. Regular staff training is the cheapest way to reduce risk, since phishing remains the main vector of initial access. To learn more about building a foundation of human preparation, read our piece "Cybersecurity: learning from scratch".
Security budget share of IT spending — the benchmark is 8–15% of total information-technology spending. This is a program-maturity indicator: if the share is systematically lower, protection is likely underfunded relative to the scale of the infrastructure.
How to choose the right cybersecurity KPIs and report to leadership
The most common mistake is measuring everything and drowning leadership in forty numbers. The discipline is in choosing metrics that actually change decisions.
Separate metrics into leading and lagging. Leading indicators signal a problem before an incident: the percentage of vulnerabilities closed on time, monitoring coverage, the frequency of completed access audits. Lagging indicators record the result after the fact: MTTR, the number of incidents, the number of audit findings. For a complete picture you need both types, but for leadership the lagging ones matter more — they show the real state, not intentions.
For a board report, collapse the whole set down to five: MTTD, MTTR, patching compliance percentage, phishing-simulation click rate, and business-recovery readiness. One "clock" for detection, one for response, one leading hygiene indicator, one leading human-factor indicator, and one resilience metric.
The key rule is to translate technical KPIs into the language of business risk. Not "MTTD grew by 2 days," but "an attacker can stay unnoticed in the network two days longer, which raises the likely cost of an incident." And define each KPI precisely to avoid ambiguity: what exactly is measured, when the countdown starts, who owns the metric, and what the target value is.
Tools for measuring cybersecurity KPIs
Measuring KPIs manually by collecting data from different systems into a spreadsheet is a path to errors and stale reports. Most metrics should be collected automatically from tools already running in the security stack.
SIEM (security information and event management) collects and correlates events from the whole infrastructure — the main source for calculating MTTD and alert volume. SOAR (security orchestration, automation and response) shortens MTTR: after confirming a malicious event, the platform automatically isolates the affected host and blocks the malicious hash across the environment, cutting hours of manual work. EDR/XDR (endpoint protection and extended detection) provides coverage data and telemetry for detection, while vulnerability scanners and security ratings provide patching and hygiene status.
Vendors in these categories include Microsoft Sentinel, Splunk, CrowdStrike Falcon, Palo Alto Networks Cortex, SentinelOne, ESET, and others. The key is not to get "locked in" to one vendor dashboard, but to set up a single place where all KPIs come together — otherwise the picture will be fragmented.
Conclusion
Cybersecurity KPIs turn protection from "we seem to be doing everything right" into a measurable, managed function. Start with the two main metrics — MTTD and MTTR — and gradually add containment time, false-positive rate, and hygiene metrics. Collapse leadership reports to five key numbers and present them in the language of business risk.
And remember: response speed matters, but it won't undo a breach that already happened. That's why proactive monitoring — checking whether your corporate accounts and data have appeared in public exposure — should be part of the regular routine. You can do this through the data-breach check on our platform. And if you want to dive deeper into cyber resilience and experience sharing between specialists, check out specialized events like Kyiv Cyber Resilience Forum 2026.
