Security KPI Dashboard Calculator

dashboard = 0.40×hygiene + 0.30×speed + 0.20×learning + 0.10×training, where hygiene = 0.30×patchSLA + 0.25×endpointCoverage + 0.25×MFAcoverage + 0.20×backupSuccess. Hygiene carries the most weight because patch currency, agent coverage, MFA coverage and backup reliability are the four measures that most consistently separate organisations that absorb an incident from those that do not. Speed is scored logarithmically so the improvement from 48 hours to 24 counts as much as 4 hours to 2. Repeat root causes are penalised directly, since recurring incidents mean post-incident actions are not being completed.

Coverage percentages hide absolute numbers — 94% endpoint coverage on 20,000 hosts is 1,200 machines nobody is watching, and that is where the intrusion will be.

This calculator takes 9 inputs: Mean time to detect, Mean time to respond, Critical patches inside SLA, Endpoints with agents reporting, Accounts on MFA, Backup job success rate, Training completion, Significant incidents per quarter, Incidents with a repeat root cause. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because coverage gaps are actively selected by attackers. The last 5% of endpoints and accounts are disproportionately legacy, unmanaged or privileged, so 95% is a floor rather than a good result.

Carefully. A rising count can mean better detection rather than worse security, which is why the model weights it lightly and pairs it with the repeat-root-cause share — that second figure is the one that cannot be explained away.