* [![perspectives](https://origin-www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2025/02/prespective-icon.png)](https://origin-www.paloaltonetworks.com.au/perspectives) * Why Cybersecurity KPIs Are Changing (And What This Means for Security Leaders) # Why Cybersecurity KPIs Are Changing (And What This Means for Security Leaders) ![Why Cybersecurity KPIs Are Changing (And What This Means for Security Leaders)](https://origin-www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/03/Why-Cybersecurity-KPIs-Are-Changing-featured.jpg) **By [Helmut Reisinger](https://origin-www.paloaltonetworks.com.au/perspectives/author/helmut-reisinger/ "Posts by Helmut Reisinger")** | **3 min read** | ![share icon](https://paloaltonetworks.com/content/dam/pan/en_US/cxo-perspectives/images/cxo-share.svg) * LinkedIn button ![linkedin-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-linkedin.svg) * Twitter share button ![twitter-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-twitter-x-black.svg) * \[Email share button ![email-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-email.svg)\](mailto:?subject=Why Cybersecurity KPIs Are Changing (And What This Means for Security Leaders)\&body=Check out this article https%3A%2F%2Forigin-www.paloaltonetworks.com.au%2Fperspectives%2Fwhy-cybersecurity-kpis-are-changing-and-what-this-means-for-security-leaders%2F "Share in Email") * ![copy-icon](https://origin-www.paloaltonetworks.com.au/perspectives/wp-content/themes/csp2025/dist/images/icons/icon-share.svg) [](https://origin-www.paloaltonetworks.com.au/perspectives/why-cybersecurity-kpis-are-changing-and-what-this-means-for-security-leaders/?pdf=download&lg=en&_wpnonce=83197ae001 "Click here to download") MEET THE AUTHOR ![](https://origin-www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2025/05/helmut-headshot-1.jpg) As CEO for Europe, the Middle East and Africa (EMEA), Helmut is responsible for all go-to-market functions across EMEA. Prior to joining Palo Alto Networks in 2022, Helmut was CEO of Orange Business Services (OBS), leading its global organization of 28,000 employees and supporting the digital transformation of enterprise customers around the world. Prior to OBS, Helmut held leadership positions across Europe at Avaya Inc., NextiraOne Germany and Alcatel Austria. Helmut holds a Ph.D. from Vienna University for Economics and Business (WU), and speaks English, French, German and Spanish. ... [Learn more](https://origin-www.paloaltonetworks.com.au/perspectives/author/helmut-reisinger/) ## IN THIS ARTICLE The rise of artificial intelligence (AI), expanding regulatory and legal requirements, and the growing sophistication and speed of cyberattacks have put cybersecurity --- and how it is measured --- front and centre for CISOs, the wider C-suite, and the board. Negative consequences that could impact businesses are now more profound than ever before. The loss of even one hour of resiliency could translate into massive financial setbacks, as well as negative impacts on customer satisfaction, consumer confidence, and trading partners. But how do you measure an organisation's ongoing cyber health and whether it is resilient? Simply waiting for the annual compliance audit and hoping for the best is not an option. ## The Two Types of KPIs You Need Static KPIs will not provide the full picture in a fast moving industry like cybersecurity. For a complete view of cybersecurity health, organisations should classify KPIs into two categories: * **Progress KPIs**illustrate progress in improving resilience and security posture effectiveness. For example, the number of tools used to protect your digital essentials, or the degree of automation. The objective of progress KPIs is to show advancements in cybersecurity posture transformation, ensuring your KPIs are developing towards or beyond regulatory or board requirements. * \*\*Effectiveness KPIs,\*\*such as mean time to detect (MTTD) and mean time to remediate (MTTR), demonstrate how well your cybersecurity set-up is able to tackle attacks and protect the enterprise. Combining these KPIs ensures continuous improvement and effort to drive 'security by design'. In the face of constant change, it is also crucial to prioritise and measure resiliency. ## Prioritising Resilience If an organisation is resilient, it can manage a number of crises including overlapping and cascading attacks. Historically, resilience tended to be measured imprecisely or not using the right data, often with very high-level KPIs that gave directional information rather than true insights. This approach no longer works because the rapidly growing number of digital interactions translates into more entry points, more threat vectors, and more successful attacks. Whilst MTTD and MTTR are still valuable measures of cybersecurity effectiveness, organisations looking to fully quantify their resilience will also need to look at the complexity of their tech stacks, the challenges associated with tools and services set-up, and how productive cybersecurity staff are. An important step towards extending the capabilities of in-house teams is building and leveraging a cybersecurity tech model that helps achieve KPIs such as resiliency, responsiveness, cost efficiency, and risk reduction. This 'platform' approach simplifies integration of disparate tools and services across a common architecture. It reduces the challenges of managing multiple vendors, tech stack complexity, tools sprawl, and redundant spending, while helping to drive faster response and improve insights into risks. True resilience is impossible to achieve without strategic and tactical collaboration between cybersecurity teams, IT colleagues, and business stakeholders. ## Helping You Build Effective Cybersecurity KPIs The organisations that will thrive in the next decade are those with perfect visibility into their risks, real-time awareness of their posture, and agility that enables them to adapt faster than threats evolve. To support senior cybersecurity and technology leaders establish the right cybersecurity KPIs, we have created a new Peer Insights guide,**Measuring risk and resilience: How to define, deliver, and report on cybersecurity KPIs.** The guide captures key insights and recommendations from experienced and innovative leaders on how they build and manage their cybersecurity KPIs. A key theme throughout the guide's chapters is cybersecurity resilience --- especially an organisation's ability to demonstrate a more sophisticated, mature approach to resilience. Download the guide [here](https://www.paloaltonetworks.co.uk/resources/guides/measuring-risk-and-resilience). * [AI](https://origin-www.paloaltonetworks.com.au/perspectives/all-articles/?cat=ai) * [Business Transformation](https://origin-www.paloaltonetworks.com.au/perspectives/all-articles/?cat=business-transformation) ## Related Content ![](https://origin-www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/03/Weaponized-Intelligence-featured.jpg) BLOG ### AI **Weaponized Intelligence** We are building the foundation that makes defense possible.... [Nikesh Arora](https://origin-www.paloaltonetworks.com.au/perspectives/author/nikesh-arora/ "Posts by Nikesh Arora") [](https://origin-www.paloaltonetworks.com.au/perspectives/weaponized-intelligence/) ![](https://origin-www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/03/RFP-Bottleneck-featured.jpg) BLOG ### AI **From Weeks to Minutes: How We Applied an AI-First Transformation to the RFP Bottleneck** Understanding why manual efforts burn hundreds of hours and are bottlenecki... [Sandeep Uttamchandani](https://origin-www.paloaltonetworks.com.au/perspectives/author/sandeep-uttamchandani/ "Posts by Sandeep Uttamchandani") [](https://origin-www.paloaltonetworks.com.au/perspectives/from-weeks-to-minutes-how-we-applied-an-ai-first-transformation-to-the-rfp-bottleneck/) ![](https://origin-www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/03/AdobeStock_704394220-16x7-1-scaled.png) BLOG ### AI **Is Your Enterprise Architecture Ready for the Agentic Workforce?** Exploring autonomous, agent-to-agent risk: Why your security needs governed... [Anand Oswal](https://origin-www.paloaltonetworks.com.au/perspectives/author/anand-oswal/ "Posts by Anand Oswal") [](https://origin-www.paloaltonetworks.com.au/perspectives/is-your-enterprise-architecture-ready-for-the-agentic-workforce/) STAY CONNECTED ## Connect with our team today Job Level Sign me up to receive news, product updates, sales outreach, event information and special offers about Palo Alto Networks and its partners. By submitting this form, I understand my personal data will be processed in accordance with Palo Alto Networks [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) and [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown). This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Reach out {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * AU Select your language