97 Things Every Information Security Professional Should Know

Chapter 10. Powerful Metrics Always Lose to Poor Communication

Ben Smith

It’s a big day!

You recently were promoted into a leadership position within information security, and next week you get to shine a light on some of the great work you and your team have been doing: your first-ever presentation to your VP, your upstream C-level executive, or perhaps even your board.

You think you’ve done your homework. You know all about the tools installed throughout your environment, and you’re eager to explain how each tool snaps into your broader vision of how to protect the organization.

Perhaps most importantly, you’ve spent a lot of time sourcing compelling metrics you will present to your audience—pulling them from your current operational reports, as well as from the standardized reports provided by many of your vendors. You’re thinking you want to take this opportunity to demonstrate all the ways that the technology you interact with daily protects the organization.

And yet, when you walk out of your presentation, you’ll realize that you missed the mark. What happened?

The most common failure point: you created your metrics and your accompanying presentation before considering your audience. Too many of us in the technology world get wrapped up in creating the perfect metric(s) to demonstrate how effective we are in our jobs. But are those the metrics your audience needs to hear ...