Historically, cybersecurity teams have relied on numbers to demonstrate progress. Vulnerabilities patched, alerts investigated, penetration tests completed, incidents detected mean time to respond: these metrics have value. They tell us whether security teams are working and processes are functioning. What they do not necessarily tell us is whether an organization is becoming more secure.

A team can patch thousands of vulnerabilities and still leave open the handful that provide an attacker with a viable route to a critical system. It can process more alerts than ever while analysts spend hours investigating issues that pose little meaningful threat. It can complete a penetration test and demonstrate improvement, only for a change in the environment the following week to introduce a whole new attack path.

The problem is that we have become very good at measuring security activity. We now need to become better at measuring security outcomes.

When Activity Doesn't Equal Risk Reduction

Security teams are dealing with more information than they can realistically act upon. Filigran's State of Threat Management Report found that 84% of cybersecurity professionals say attacks often exploit risks that organizations already knew about but had not prioritized.

Moreover, analysts spend 43% of the working week, equivalent to around 17 hours, investigating risks that ultimately turn out to be low priority.

These figures expose a fundamental problem. Security teams can be extraordinarily busy while effort is still being directed towards the wrong things. Organizations now have vulnerability scanners, cloud security tools, attack surface management platforms, threat intelligence feeds and numerous other sources telling them where weaknesses might exist. Yet only 41% say they have a fully consolidated view of their cyber risk exposure.

More information does not automatically create better decisions. Without sufficient context, another vulnerability or alert simply becomes another item competing for attention. 

Take, for instance, the last quarterly security report to the board. For each metric, ask: if this number doubled, can you say more confidently that we are harder to be attacked?

If the answer is "not necessarily," it's an activity metric not quantified risk reduction. Most teams find that the majority of what they report falls into this category.

Measuring What Attackers Can Actually Exploit

A more useful measure of security performance starts with validated exposure. The research found that 97% of organisations struggle to determine whether security exposures are exploitable, leaving teams to prioritize based on incomplete evidence.

Metrics should show whether critical attack paths have been removed and controls work against relevant attack techniques.

Consider a team that patches 500 vulnerabilities in a month. Another patches just 50, but knows those weaknesses form attack paths to its most important systems and confirms through retesting that those routes have closed. The second team has stronger evidence that risk has fallen, giving CISOs a clearer outcome to communicate to senior leadership.

Marking an exposure as remediated should therefore trigger validation. Before closing critical or high-risk exposures, retest to confirm the fix worked and check whether alternative routes remain. Track how many fixes fail retesting, and apply the same principle to security controls by measuring whether they detect or prevent the attacks they were designed to address.

Why Point-in-Time Testing isn’t Enough

Exposure does not stand still. Cloud environments change, software is updated, new vulnerabilities emerge, identities and permissions change, employees connect new services and attackers develop new techniques.

A successful penetration test therefore provides evidence about the organization at a particular moment in time. It cannot guarantee that the same environment will remain secure weeks or even days later.

The study found that 88% of security professionals agree that periodic assessments alone are no longer sufficient to manage risk effectively. Yet only 38% currently use threat intelligence within a continuous, fully automated validation process. Measuring cyber resilience requires more than establishing that a control worked once.

Continuous validation turns security measurement from a periodic scorecard into an ongoing feedback loop: identify what matters, test whether it can be exploited, remediate it, validate the fix and repeat the process as conditions change.

You don't need to test everything continuously on day one. Start by defining triggers that should prompt revalidation: a new threat actor campaign targeting your sector, a major infrastructure or identity change, a newly exploited vulnerability in software you run. Event-driven testing is a practical first step towards continuous validation.

AI Makes Outcomes More Important

Security teams already face a scale problem, with 88% of organizations saying greater automation is necessary to keep up with the volume of risks they need to assess. Today, an average of 37% of exposure management processes are AI-driven, with organizations expecting this to reach 59% within two years.

There are clear opportunities here. Respondents see particular value in applying AI and automation to detecting exposures, determining whether they are exploitable and prioritizing remediation based on real business risk.

But speed cannot itself become the new measure of success. An AI system that enables a security team to process twice as many exposures is useful only if it helps the organization identify and reduce the risks that matter. Otherwise, automation risks speeding up an already inefficient process.

Organizations therefore need to measure AI's impact in terms of outcomes. Has it improved prioritization? Are critical exposures being identified sooner? Has the time between identifying and validating a serious risk fallen? Are fewer analyst hours being consumed by issues that ultimately prove insignificant?

Before deploying AI in your exposure management workflow, baseline three numbers: analyst hours spent on non-exploitable issues, time from identification to validation of critical exposures, and the proportion of remediated items confirmed by retest.

Measure them again after 90 days. If they haven't moved, the AI is speeding up activity, not reducing risk.

A Better Definition of Security Performance

None of this means organisations should stop measuring operational performance. Metrics such as patching rates, alert volumes and response times still provide useful information, but they should be viewed as inputs rather than the ultimate measure of success.

The next generation of security metrics needs to answer more important questions: What can attackers actually exploit? Which attack paths lead to the assets that matter most? Are our controls effective against relevant threats? Did remediation genuinely remove the exposure? And is measurable risk declining over time?

This is the difference between measuring cybersecurity work and measuring cybersecurity resilience. The goal should be to continuously identify the risks most likely to matter, validate them against the real environment and demonstrate that action has materially reduced exposure.

Where to Start

• ​Pick one critical business service and map the attack paths that lead to it, don't try to boil the ocean
• Use threat intelligence to narrow scope to the actors and techniques actually relevant to your sector and region
• Validate those paths against your real controls, not assumptions
• Remediate, retest, and record the result as "attack path removed," not "vulnerability patched"
• Report one outcome metric to the board next quarter alongside your usual activity metrics, and let the contrast make the case

The most important cybersecurity metric isn't how much work the security team completed. It's whether the organization is harder to attack as a result.