Risk Reduction Over Time
Percentage reduction in overall security risk based on implemented controls
Current Value
43%
+15% from previous period
Industry average: 31%
Calculation Method
Calculation based on risk register severity scores and control effectiveness metrics, showing percentage reduction from baseline/inherent risk
Significance
This KPI demonstrates how effectively your security program is reducing organizational risk over time, providing a direct measure of security program value.
Definition
Risk Reduction Over Time measures the percentage reduction in overall security risk from a baseline inherent risk score. It quantifies how much risk has been mitigated through the implementation of security controls and processes compared to having no controls in place.
Significance
This KPI directly demonstrates the value of your security program by showing how much risk has been reduced through security investments. It provides a clear, quantitative measure that can be communicated to executive leadership.
Risk reduction is ultimately the core purpose of any security program. This metric helps security leaders justify investments, prioritize future initiatives, and demonstrate progress against strategic objectives.
Calculation Method
Risk Reduction = (1 - (Current Residual Risk Score / Baseline Inherent Risk Score)) × 100%
Calculation components:
- Assessment of inherent risk (before any controls) using a consistent scoring methodology
- Evaluation of control effectiveness for each implemented control
- Calculation of residual risk scores after applying control effectiveness
- Comparison of current residual risk to baseline inherent risk
Benchmark
Industry average: 31% risk reduction
Best practice target: Continuous improvement, with a target of at least 50% risk reduction
Performance Trends
Risk reduction has increased from 28% to 43% over the past 18 months, representing a significant improvement in our security posture. The greatest improvements have been in application security (22% to 58%) and data protection (30% to 62%).