Last updated: April 29, 2026
Why this module. Engineering teams measure DORA. Security teams measure CVE backlog. DevSecOps requires a unified metric set — measuring how secure software is delivered, not just secure or how fast. This module is the metrics blueprint.
DORA — the engineering baseline
- Deployment Frequency — how often code reaches production
- Lead Time for Changes — commit to production time
- Change Failure Rate — % of deployments causing incidents
- Mean Time to Recover — how fast from incident to recovered
“Elite” teams: deploy multiple times daily, lead time < 1 hour, CFR < 15%, MTTR < 1 hour.
DORA + security overlay
Add security to each:
- Deployment Frequency (Security) — % of deploys that include security improvements
- Lead Time (Security) — time from CVE published to patched in production
- Change Failure Rate (Security) — % of deploys that introduce a security regression
- MTTR (Security) — time from breach detection to containment
Vulnerability metrics
- Mean Time to Detect (MTTD)
- Mean Time to Remediate (MTTR-vuln)
- SLA Compliance — % of vulns resolved within priority SLA
- Backlog Aging — distribution of vuln age
- New vs Resolved — net flow per week
The BSIMM maturity model
BSIMM (Building Security In Maturity Model) — observed practices across hundreds of companies. 121 activities across 12 practices. You score yourself; benchmark against industry.
BSIMM observations: most enterprises sit at 30-60% activity coverage. Top quartile cover 70-85%.
OWASP SAMM
Lighter alternative. 5 business functions × 3 practices each × 3 levels of maturity.
Practical for SMBs; full-form takes 1-2 days to assess vs BSIMM’s weeks.
The metrics dashboard hierarchy
- Operational (daily) — failed builds, vuln backlog, SLA breaches, incidents
- Tactical (weekly) — DORA + security trends, top 10 vulns
- Strategic (monthly) — maturity progress, headcount-adjusted productivity, customer-impacting incidents
- Executive (quarterly) — risk trend, regulatory readiness, peer benchmark
The metric that backfires
“Number of vulns found” — celebrates noise. The team that finds 1000 vulns isn’t better than the team that finds 100; might be using a worse scanner with more false positives.
Better: “Number of vulns prevented per release” — incentivises pre-commit and SAST quality. Or: “Time from CVE publication to patched in production” — incentivises automation.
Defender’s checklist
- DORA metrics measured + security overlay added.
- Vuln SLA defined; compliance tracked.
- BSIMM or SAMM self-assessment annually.
- Dashboard hierarchy from operational to executive.
- Quarterly review with engineering leadership.
- Beware vanity metrics; reward outcomes not activity.
Module Quiz · 6 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.