Cybersecurity has outgrown its roots as a siloed IT function. It now sits at the heart of business strategy—shaping digital transformation, guiding risk management decisions, and influencing customer trust. The stakes have never been higher: security breaches can jeopardize not just systems, but reputations, shareholder confidence, and bottom lines.
In fact, according to IBM’s Cost of a Data Breach Report 2025, the global average cost of a data breach now stands at USD 4.44 million, underscoring the very real financial impact security incidents can have on organizations worldwide.
The evolution of security demands a parallel transformation in how organizations measure and communicate its value. Traditional metrics—e.g., incident response times, patching cadence, system uptime—while still important, no longer tell the full story. Executive leadership and board members want more than technical indicators; they want clarity on how security initiatives contribute to organizational resilience, regulatory compliance, and ultimately, profitability.
This shift demands a new mindset—one that reframes security as a business enabler rather than a cost center. But how do teams translate technical wins into business value? What metrics apply to today’s security programs? And how can security leaders demonstrate return on investment (ROI) in language that resonates from the server room to the C-suite?
To explore these critical questions, we sat down Jason Smith, Global Director of Security Operations at Syntax. Read on for actionable insights that will help you redefine success, align security metrics with core business objectives, and build the case for continued investment in your security program.
Q: What factors have driven the evolution of security from a technical function to a business enabler?
Three major factors have catapulted security to the forefront of business conversations in recent years. First, the public at large has become much more educated about the impacts of attacks and the inherent responsibility of organizations to prevent them, and the public is also much more willing to hold organizations responsible for data and privacy losses. Second, regulatory requirements mandating cybersecurity framework adherence under financial penalty can significantly harm the operating ability of a business if it is found non-compliant. Last but not least, security tools and services are much more modular than they have been in the past, offering the ability to be purchased alongside other IT solutions with additional training.
All of these factors anchor an organization to an obvious conclusion: If they do not do what is required to protect themselves and customer data, the financial and legal implications that follow would seriously injure their ability to continue to operate.
Q: Given this shift, how has the approach to measuring its effectiveness changed? What were some commonly used metrics in the past, and what key areas should security teams prioritize today to align with broader business goals?
The approach to measuring security operation effectiveness has shifted from a focus on tactical measurements of day-to-day operations to a measure of an organization’s readiness to respond to security incidents as a whole. This measurement can be referred to as a security operation’s maturity level. While it may include activities that the security team performs daily, the true measurements come from outcomes achieved, such as the ability to pass an audit or mitigate a breach within the network. A team can only achieve this kind of measurement by integrating with additional business units within the organization, emphasizing the shift in how important security has become.
Q: Should security teams adapt key performance indicators (KPIs) to align with the unique priorities of different roles and functions within an organization?
Yes, to a degree. Setting the roles and responsibilities of security team members such that they are naturally supported—and supported by the different teams driving business outcomes throughout the organization—is most important. Following this, the measurement of KPIs will naturally evolve with the priorities of the organization, so long as those relationships are managed correctly from a stakeholder level.
As an example, where a measurement for mean time to resolve (MTTR) may span the time from when a potential security incident is raised to the security team to the moment that security incident is resolved, MTTR can evolve to become inclusive of other teams activities, like internal IT, Legal, and HR. This allows each team to demonstrate and be held accountable to their contribution to the successful resolution of potential security incidents.
Q: Security teams often struggle to quantify the performance and impact of their programs. What are the primary challenges they face?
The struggle to quantify the performance and impact of security programs is threefold. First, the lack of data on what teams are doing on a day-to-day basis, either lost in maladapted IT service management (ITSM) systems or more accessible team chats, prevents a team from effectively measuring how it is fulfilling its responsibilities to the organization. Second, there are always intangible efforts that get lost in the shuffle. A hallway conversation, a quick ask in a team chat, or an emergency that requires immediate action are rarely documented effectively—which hurts the team’s ability to talk about the good work they do. Third, leaders struggle to measure the team’s success without quantitative numbers. Qualitative approaches are often overlooked as an option, even though they can be quite effective and lead to more quantitative metrics.
Q: How can organizations address these obstacles to ensure meaningful measurement and reporting?
Given the nature of the work that security teams perform, it is often extremely difficult to introduce new systems of documentation or even new procedures for using existing documentation. Strong relationships between security leadership, internal stakeholders, and data controllers for data sources that track security team activity are incredibly important, allowing for changes to be made to systems capturing security team activity with minimal friction.
Designing documentation systems that are efficient at capturing the impact and priority of non-traditional security activities can mitigate the issues caused by ad hoc requests.
Finally, designing metrics that combine qualitative and quantitative approaches can be extremely effective at approximating the work that is being performed by the team while more robust systems of measurements are built.
Q: Traditional security metrics often fail to resonate with business leaders. What are the most effective ways to communicate the value of security programs and demonstrate ROI to the C-suite and board? How can teams translate technical outcomes into business language?
The approach normally depends on business leadership—some have been educated in cybersecurity topics and want to understand the return on investment (ROI) from a technical and monetary level, and some want a one-page document detailing whether the company is safe from threats. Taking the audience into consideration, all the activities of the security team must ultimately boil down to the monetary impact it has on the organization. This can be the ROI of implementing security controls that mitigate potential threats, the savings that are realized by implementing different types of efficiencies within the organization, or the maintenance/reduction of security costs over time.
Metrics also differ with the type of security organization. For example, an Managed Service Provider (MSSP) will have much different metrics to report than a security team working within a large enterprise organization.
Q: What are your top three actionable best practices for measuring the effectiveness of security programs?
First, the systems that a security operations group builds to effectively operate within an organization’s environment should reflect the reality of what the team is trying to achieve.
Second, ensuring that the data captured for security activities is whole and accurate, early and often, prevents having to refactor and rebuild systems of metrics as you build them.
Third, communication with stakeholders and business leaders is key. This is the easiest way to discover the value that they currently see in the security team and if they want to see something more.
Q: Anything else you’d like to add on this topic?
Security metrics are not easy to compile, even in the most mature organizations. The volatile nature of the cybersecurity landscape requires constant adaptation, and it is not always clear how you can demonstrate value.
What helps keep metrics and the security organization relevant is the communication and relationships that the group forms outside of the security space.
The relationships with stakeholders and peers often provides more value to the business and helps security become integrated more effectively with daily operations. As these relationships continue to be established, the metrics and measurements follow more easily.
In today’s threat landscape, measuring security’s true value means looking beyond technical performance to its impact on the business.
At Syntax, we combine decades of experience, global expertise, and advanced capabilities to help organizations not only protect their assets but also demonstrate the business value of their security investments.