Most security dashboards report activity: how many alerts, how many patches, how many logins flagged. Activity is not risk. A team can process ten thousand alerts and still be one compromised laptop away from a serious incident.

Indicators worth watching

Time to patch a critical vulnerability across internet-facing systems. Share of assets with a known owner. Time to revoke an access credential after a role change or a departure. Whether a fresh login from an unusual location triggers something a human will see. Each is small, and each is hard to fake.

Indicators that mostly reassure

The percentage of employees who clicked a phishing simulation. The number of tools purchased. A certification held by the team. They correlate weakly with incidents and are easy to improve without changing anything material.

The exercise matters more than the dashboard

The cheapest useful test is a timed restore from backup, performed by someone who did not set the backup up. The second cheapest is revoking a user account and confirming it takes effect everywhere. Both expose gaps no dashboard will show.

For an organisation unsure where to start, pick one indicator, measure it honestly, and let the number set the priority for the quarter.