Measuring What Matters : AI 시대의 데이터 기반 사이버 보안 지표 프레임워크

This IDC Perspective, Part 2 of a two-part series on cybersecurity metrics, presents a data-driven, three-tier metrics framework, governance, managerial, and operational, that enables organizations to measure what matters at every level of the enterprise. Cybersecurity metrics have long been misunderstood, reported as technical operational measures when what executives and board members need are strategic, risk-based insights tied directly to business outcomes.The emergence of AI has fundamentally changed the metrics imperative on two fronts. On the offensive side, AI-weaponized attacks are accelerating in scale, sophistication, and speed, compressing the time available to detect and respond. On the defensive side, organizations are deploying AI into products, services, and decision-making faster than governance can keep pace, creating a new class of enterprise risk that traditional metrics frameworks were never designed to capture.This document extends the three-tier framework with dedicated AI risk metrics, covering shadow AI, regulatory compliance posture, agentic AI risk, model IP protection, and SaaS-embedded AI. Organizations that implement GRC platforms with native AI governance capabilities, align metrics to business risk, and empower audience-specific decision-making with transparent, validated insights will be best positioned to lead with confidence in today's AI-driven threat and regulatory environment."The age of AI demands a fundamental rethink of how organizations measure cybersecurity risk. Reporting firewall blocks to boards while AI systems operate without governance, measurement, or accountability is no longer acceptable. Data-driven metrics, built on a consolidated intelligence platform and extended to capture AI-specific risk at every audience level, are no longer a best practice. They are a business imperative," says Philip Harris, research director, Governance, Risk, and Compliance Solutions, IDC.

Executive Snapshot

• Key takeaways
• Recommended actions

Situation Overview

• Built in reverse: Why cybersecurity metrics are misunderstood
• Accountability reaches the boardroom: Why the status quo can no longer be tolerated
• Three barriers, one blind spot: Why the metrics gap has persisted
• What traditional metrics delivered, and what they didn't
• From patch counts to plain language: What organizations actually need
• AI has introduced two new and urgent dimensions
• Data-driven metrics
  • Qualities of data-driven metrics
  • Elements to consider in crafting metrics
    • Understanding the risks
    • Aligning data collection
    • Analyzing the data
    • Interpreting the results
    • Considering the stakeholders
    • Empowering decision-making
    • Monitoring and optimizing
    • Establishing processes and guidelines

Advice for the Technology Buyer

• What is needed for data-driven metrics
• The role of GRC platforms and the intelligence fabric
• What the fabric adds to the risk register
• What the fabric enables
• Appropriate metrics by audience
  • Board of directors metrics
  • What board of directors metrics are
  • What board of directors metrics are not
  • Audience
  • Categories and details
• Managerial metrics
  • Audience
  • Categories and details
• Operational metrics
  • Audience
  • Categories and details
• Benefits

Learn More

• Related research
• Synopsis