What are the best key performance indicators for threat modeling?

1 Number of threats identified

One of the simplest and most direct KPIs for threat modeling is the number of threats identified for each system, component, or scenario. This metric indicates how comprehensive and thorough your threat modeling process is, and how well you understand the attack surface and the potential vulnerabilities of your system. A higher number of threats identified means that you have a more complete picture of the risks you face, and that you can prioritize and address them accordingly. However, this metric should not be used in isolation, as it does not reflect the quality, severity, or likelihood of the threats, nor the effectiveness of the mitigation measures.

2 Number of threats mitigated

Another important KPI for threat modeling is the number of threats mitigated, or the percentage of threats that have been resolved or reduced by implementing security controls. This metric indicates how successful and efficient your threat modeling process is in translating the identified risks into actionable and measurable solutions. A higher number of threats mitigated means that you have a more secure and resilient system, and that you have reduced the exposure and impact of potential attacks. However, this metric should also be balanced with other factors, such as the cost, complexity, and performance of the security controls, and the remaining residual risks.

3 Number of incidents prevented

A more outcome-oriented KPI for threat modeling is the number of incidents prevented, or the number of potential attacks that have been blocked or deterred by your security controls. This metric indicates how effective and relevant your threat modeling process is in anticipating and preventing real-world threats, and how well your security controls perform under attack. A higher number of incidents prevented means that you have a more robust and reliable system, and that you have avoided or minimized the consequences of security breaches. However, this metric may be difficult to measure accurately, as it depends on the visibility and attribution of the attacks, and the counterfactual scenarios of what would have happened without the security controls.

4 Number of incidents detected

Another outcome-oriented KPI for threat modeling is the number of incidents detected, or the number of actual attacks that have been discovered and reported by your security controls. This metric indicates how responsive and agile your threat modeling process is in detecting and responding to real-world threats, and how well your security controls alert and inform you of the attacks. A higher number of incidents detected means that you have a more aware and proactive system, and that you have reduced the dwell time and damage of security breaches. However, this metric may also be influenced by the frequency and intensity of the attacks, and the false positives and negatives of the security controls.

5 Number of incidents resolved

The final outcome-oriented KPI for threat modeling is the number of incidents resolved, or the number of actual attacks that have been contained and remediated by your security controls. This metric indicates how resilient and adaptive your threat modeling process is in recovering and learning from real-world threats, and how well your security controls mitigate and correct the effects of the attacks. A higher number of incidents resolved means that you have a more stable and improved system, and that you have restored the normal operations and trust of your system. However, this metric may also depend on the severity and complexity of the attacks, and the resources and skills required to resolve them.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?