Cybersecurity needs a new KPI: it's time to measure our ability to adapt

For years, cybersecurity has become increasingly measurable.

Security leaders can often tell you how long it takes to detect an intrusion, contain an attack and restore normal operation.

Those figures have given boards a straightforward way to judge progress, offering reassurance that investment in security is delivering real improvements.

Metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) have earned their place at the table.

They both provide a clear picture of how effectively security teams perform when something goes wrong and have helped drive better incident response across the industry.

The problem is not that these metrics are wrong.

They were designed for a different era, when technology changed more slowly, attack methods evolved over longer timescales and AI wasn't yet part of the equation.

Today's businesses are introducing new technologies at an extraordinary pace.

AI is becoming embedded across organizations, cloud environments continue to expand and businesses are more interconnected than ever before.

At the same time, attackers are constantly adapting their own techniques, taking advantage of new tactics and tools almost as quickly as they emerge.

CISO’s and boards need to dynamically review the changing threat landscape and risk posture and ask themselves whether the metrics relied on for years still tell us everything we need to know.

Mind the gap Every business wants to detect attacks sooner, contain them faster and recover with minimal disruption.

That’s why MTTD and MTTR remain valuable operational measures.

They tell us how effectively a security team performed once an incident was underway.