Security Metrics and KPIs

Actionable metrics include MTTD (mean time to detect), MTTR (mean time to respond), % of patches applied within 30 days, false positive rate, and asset coverage by security controls.