Measuring What Matters: A Data-Driven Cybersecurity Metrics Framework for the Age of AI

This IDC Perspective, Part 2 of a two-part series on cybersecurity metrics, presents a data-driven, three-tier metrics framework, governance, managerial, and operational, that enables organizations to measure what matters at every level of the enterprise. Cybersecurity metrics have long been misunderstood, reported as technical operational measures when what executives and board members need are strategic, risk-based insights tied directly to business outcomes.The emergence of AI has fundamentally changed the metrics imperative on two fronts. On the offensive side, AI-weaponized attacks are accelerating in scale, sophistication, and speed, compressing the time available to detect and respond. On the defensive side, organizations are deploying AI into products, services, and decision-making faster than governance can keep pace, creating a new class of enterprise risk that traditional metrics frameworks were never designed to capture.This document extends the three-tier framework with dedicated AI risk metrics, covering shadow AI, regulatory compliance posture, agentic AI risk, model IP protection, and SaaS-embedded AI. Organizations that implement GRC platforms with native AI governance capabilities, align metrics to business risk, and empower audience-specific decision-making with transparent, validated insights will be best positioned to lead with confidence in today's AI-driven threat and regulatory environment."The age of AI demands a fundamental rethink of how organizations measure cybersecurity risk. Reporting firewall blocks to boards while AI systems operate without governance, measurement, or accountability is no longer acceptable. Data-driven metrics, built on a consolidated intelligence platform and extended to capture AI-specific risk at every audience level, are no longer a best practice. They are a business imperative," says Philip Harris, research director, Governance, Risk, and Compliance Solutions, IDC.