Building a Simple Security Dashboard to Track Your Security and Resilience Progress.
At an annual review meeting, a Sligo services company's managing director asked the IT provider how the security of the business had changed over the past year. The IT provider confirmed that several improvements had been made — MFA had been rolled out, a backup system had been upgraded, and staff had completed awareness training. The managing director asked what the current state of security was — not the improvements made, but the actual status right now. The IT provider did not have a ready answer.
Security investment without measurement is faith, not management. A board that approves security spending without metrics cannot evaluate whether it is producing improvement, whether the improvement is sufficient, or where the next investment should go.
A security dashboard does not need to be sophisticated. It needs to show the current state of the controls that matter most, and the trend over time.
What to Measure: The Six Metrics That Matter Most for Irish SMEs
MFA coverage rate. The percentage of user accounts with MFA enabled. Target: 100%. Measured from the Microsoft 365 admin centre or equivalent. A rate below 100% is an immediate action item — the uncovered accounts are the specific risk.
Patch compliance rate. The percentage of devices with all critical security patches applied within the required timeframe (typically seven days from release). Measured from Intune, your endpoint management tool, or your IT provider's patch report. A rate below 90% requires investigation of which devices are non-compliant and why.
Backup test date. The date of the most recent successful backup restore test. If this date is more than 90 days ago, it is amber. If it is more than six months ago, it is red. Not whether a backup is running — when it was last confirmed to work.
Simulated phishing click rate. From your phishing simulation programme, the percentage of staff who clicked the most recent simulated phishing email. Measured quarterly. The trend line — are staff getting better? — is the most meaningful element.
Open critical vulnerability count. The number of known, critical vulnerabilities in your environment that have not been addressed. Zero is the target. Measured from vulnerability scanning or your IT provider's assessment. Any number above zero requires a timeline for resolution.
Days since last security incident review. How long since management reviewed the security incident log? This metric drives the management engagement that is necessary for security culture. Target: monthly.
Could you produce a version of this dashboard right now from information your IT provider already has? The data exists in your environment. The question is whether it is being surfaced and reviewed regularly. Book a free 20-minute strategy call — management reporting design is a standard component of our vCISO engagements with Irish SMEs.
Format: One Page, Monthly
A security dashboard for an Irish SME board or management team should be one page. It should be produced monthly — or, at minimum, quarterly. It should show: the current value of each metric, the target value, the status (green/amber/red), and the trend from the previous period.
The format is less important than the consistency. A well-structured spreadsheet, a simple table in a board report, or a dedicated dashboard tool all serve the same purpose. What matters is that the same metrics are reviewed at the same frequency, and that the review produces action decisions when metrics are amber or red.
Linking Metrics to Investment Decisions
The value of a security dashboard is not just tracking — it is informing decisions. A dashboard showing that patch compliance has been consistently below 90% for three months is an argument for investing in automated patch management. A dashboard showing that the phishing click rate has not improved over four simulations is an argument for changing the awareness programme approach.
A board that can see the metrics can make informed decisions about security investment. A board that cannot see the metrics is approving security budgets on trust. Both situations exist in Irish SMEs. The dashboard is what distinguishes them.
Building the Dashboard Without New Tools
For most Irish SMEs, the data for all six metrics above is available from tools already in use — Microsoft 365 admin centre, Intune, the backup platform, the phishing simulation tool. The dashboard is built by extracting these metrics monthly and presenting them in a consistent format.
Assigning a named person the monthly task of producing the dashboard — typically the IT lead or the vCISO — and a named meeting where it is reviewed creates the accountability structure that makes measurement meaningful.
What Next
Define your six metrics this week. Use the list above or adapt it to your environment. Agree the targets.
Produce a first dashboard from currently available data. It will be incomplete — some metrics will require new data collection. But a first version with the data available reveals where the gaps are.
Add a monthly security metrics review to the management calendar. Fifteen minutes, monthly. The six metrics. The trend. The action decisions for anything amber or red.
Ready to find out exactly where your business stands? Book a free 20-minute strategy call at www.pragmaticsecurity.ie/book-a-call.
Related Reading
- Creating a 12-Month Security Roadmap for Your Irish Business
- Board-Level Cyber Risk: What Owners and Directors Should Be Asking
- Prioritising Security When Budgets Are Tight
[^1]: NCSC Ireland — Security Measurement Guidance [^2]: Data Protection Commission Ireland [^3]: An Garda Síochána — National Cyber Crime Bureau
Pragmatic Security — Cybersecurity advisory for Irish businesses. Based in Donegal, Ireland. CISA, CISSP, CISM certified advisors.