A security metric should help someone make a decision.

When I put a number in front of a leader, I want it to help them decide what to do next.

Counts tell us how much work exists. They help us manage capacity and spot accumulation. A leadership conversation needs another layer: what the work means for the business, whether our actions are changing the exposure, and where a decision is needed.

Begin with what someone can act on

Before putting a metric on an executive dashboard, ask what should happen when it changes. Should we allocate capacity, accelerate a remediation, escalate a dependency, or revisit a risk decision? If the answer is unclear, the measure may need more context.

For vulnerability management, I would connect technical findings to affected services, plausible attack paths, potential business consequences, and the time that meaningful exposure remains open. I would also show throughput, because a team can reduce an important risk while still building an unsustainable backlog.

Explain progress without overstating it

Closing findings is evidence of activity. Whether it represents material risk reduction depends on what was closed and how the remediation was verified. Leaders need that distinction so they can support the right work.

When a control is being introduced gradually, explain its current behaviour. A control that produces warnings can improve visibility and help teams prepare. A control that blocks a release changes the operating boundary. Both stages can be valuable, but they tell different stories about protection.

Make the tradeoff understandable

A serious exposure may need an urgent fix. The affected service may also have a difficult change window or a dependency that creates disruption risk. We should explain those constraints, identify interim protection where possible, and put the decision with the accountable owner.

OSFI’s B-13 guidance for federally regulated financial institutions connects technology and cyber risk management with resilience and digital innovation. I find that a useful leadership lens: a security update should address both protection and the ability to operate.

A useful update explains the exposure, the response, and the decision that will move us forward.

My preferred structure is simple: what changed, why it matters, what we are doing, and what support we need. Keep the evidence available. Make the main message clear enough that the audience can explain it without us in the room.