AI 시대의 제공업체 로드맵 : 이사회, 경영진, 보안 책임자를 위한 데이터 기반 사이버 보안 지표 제공

This Market Perspective discusses how organizations worldwide are failing to deliver cybersecurity metrics that serve their boards, executives, and operational teams - and how the emergence of AI has widened that gap. For technology providers and service providers, this represents one of the most significant product and service differentiation opportunities available in the governance, risk, and compliance (GRC) and cybersecurity market. This document, part 1 of a two-part series on cybersecurity metrics, defines the customer problem landscape and the three-tier metrics framework providers can build, deliver, and monetize.The customer problem is well established but persistently unsolved: Cybersecurity grew bottom up, producing tactical metrics that never served governance or strategic audiences. AI has added two urgent new dimensions - AI-weaponized attacks that existing metrics frameworks cannot measure and ungoverned internal AI deployments creating a new class of enterprise risk. Providers that build solutions addressing both dimensions will occupy a dominant and defensible position in the GRC and cybersecurity market.GRC platforms are uniquely positioned to address this need by consolidating intelligence across business, IT, and cybersecurity domains into an audience-specific metrics engine. Providers that extend this intelligence fabric to incorporate AI-specific signals - including AI model inventories, shadow AI detection, AI output logs, and regulatory compliance mapping - will deliver the next generation of cybersecurity metrics solutions customers urgently need and currently cannot find."The cybersecurity metrics market is at an inflection point. Customers are being held accountable for AI risks they cannot yet measure, and boards are demanding business risk context that most security tools still cannot deliver. Technology and service providers that step into this gap - with consolidated intelligence platforms, audience-specific metrics, and AI governance capabilities - will define the next generation of cybersecurity and GRC market leadership," says Philip Harris, research director, Governance, Risk, and Compliance Solutions at IDC.

Executive Snapshot

• Key takeaways
• Recommended actions

New Market Developments and Dynamics

• "What we've got here is ... failure to communicate"
  • Why cybersecurity metrics are misunderstood
  • Why executive and board meetings fail to communicate cyber-risk effectively
  • Why traditional metrics failed everyone
  • AI has introduced two new and urgent dimensions to this challenge
  • Data-driven metrics
    • Qualities of data-driven metrics
    • Elements to consider in crafting metrics
  • What is needed for data-driven metrics
• The role of GRC platforms and the intelligence fabric
  • What the fabric enables

Advice for the Technology Supplier and Services Provider

• Strategic governance metrics
  • Understanding the board audience
  • What boards need to understand
  • What governance metrics should deliver
• Managerial metrics
  • What AI dimensions managerial metrics must now address
• Operational metrics
  • What AI dimensions operational metrics must now address
    • AI system inventory and governance
    • AI attack surface and threat management
    • Shadow AI and unauthorized use
    • AI output and hallucination monitoring
    • AI data protection
• Cybersecurity tools and metrics

Learn More

• Related research
• Synopsis