CTEM Metrics and Reporting: What to Measure and Share

• Operational metrics that tell you if the program is running
• Risk metrics that tell you if the program is working
• How to structure executive and board reports
• Common reporting mistakes to avoid

Operational metrics

• Discovery coverage per scope
• Time from discovery to inclusion in the register
• Top-N triage completion rate
• Validation throughput
• Mobilization aging (open exposures by age bucket)

Risk-reduction metrics

• Mean time to remediate validated top-N
• Number of validated attack paths closed
• Reduction in high-impact exposures on crown-jewel assets
• Coverage of business services under CTEM

Executive report structure

1. Business-service risk headline (green/amber/red with trend)
2. Top exposures closed and remaining
3. Attack paths validated and closed
4. Blockers requiring executive attention
5. Next month focus

• Pick five metrics, no more, for the exec report
• Automate the operational metrics; do not hand-collect
• Add a business-service view to every report
• Review metric usefulness quarterly

• Reporting scanner counts as risk
• Changing metrics every month
• Reporting without trend lines
• Never linking metrics to business services