Lion Cipher Lab
Build a security metrics program (KPIs, MTTD/MTTR, a board scorecard)
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
"You cannot manage what you do not measure" is the whole reason security leaders keep a job — but the same instinct produces dashboards full of numbers that impress no one and change no decision. A GRC or security-leadership role lives or dies on being able to walk into a board meeting with a handful of metrics that tie to risk, show a trend, and force a decision. This lab has you build that muscle for real: you compute the two numbers every incident-response program is judged on (MTTD and MTTR) from actual data, then put them on a one-page scorecard a non-technical board can act on.
What you'll learn
- Designing security KPIs tied to objectives and risk appetite
- Leading vs lagging indicators
- Computing MTTD and MTTR from incident data
- Building a board-ready RAG scorecard
- Spotting and killing vanity metrics
Steps in this lab
- Why measure at all — and the vanity-metric trap
- Leading vs lagging, and tie every metric to an objective
- Choose a small KPI set — resist the urge to measure everything
- Create a sample incident dataset (the hands-on core)
- Compute MTTD and MTTR with a short Python script
- Assemble the one-page board scorecard
- The way a pro does it better — audience, dollars, and automation