Measuring What Matters : 고객에게 필수적인 사이버 보안 지표 플랫폼 구축

This IDC Market Perspective, part 2 of a two-part series on cybersecurity metrics, defines a data-driven, three-tier metrics framework (governance, managerial, and operational) that providers can build, deliver, and monetize. Organizations worldwide are failing to measure cybersecurity risk in ways that serve their executives, boards, and operational teams, and the emergence of AI has widened that gap. For technology providers and service providers, this represents one of the most significant differentiation opportunities in the GRC and cybersecurity market.AI is reshaping the threat landscape on two fronts: accelerating adversarial attacks and deploying AI internally without adequate governance. Neither dimension is captured by traditional cybersecurity metrics. Providers that embed AI-specific risk measurement capabilities, from shadow AI detection to agentic AI governance and SaaS-embedded AI visibility, into their platforms will address a critical, unmet customer need across every industry and organization size.This document extends the three-tier framework with dedicated AI risk metrics covering shadow AI, regulatory compliance posture, agentic AI risk, model IP protection, and SaaS-embedded AI. Organizations that implement GRC platforms with native AI governance capabilities, align metrics to business risk, and empower audience-specific decision-making with transparent, validated insights will be best positioned to lead with confidence in today's AI-driven threat and regulatory environment."The age of AI demands a fundamental rethink of how organizations measure cybersecurity risk. Reporting firewall blocks to boards while AI systems operate without governance, measurement, or accountability is no longer acceptable. Data-driven metrics, built on a consolidated intelligence platform and extended to capture AI-specific risk at every audience level, are no longer a best practice. They are a business imperative," says Philip Harris, research director, Governance, Risk, and Compliance Solutions, IDC.

Executive Snapshot

• Key takeaways
• Recommended actions

New Market Developments and Dynamics

• Built in reverse: Why cybersecurity metrics are misunderstood
• Accountability reaches the boardroom: Why the status quo can no longer be tolerated
• Three barriers, one blind spot: Why the metrics gap has persisted
• What traditional metrics delivered, and what they didn't
• From patch counts to plain language: What organizations actually need
• Weaponized and ungoverned: AI's two new risk dimensions
  • Data-driven metrics
    • Qualities of data-driven metrics
    • Elements to consider in crafting metrics
      • Understanding the risks
      • Aligning data collection
      • Analyzing the data
      • Interpreting the results
      • Considering the stakeholders
      • Empowering decision-making
      • Monitoring and optimizing
      • Establishing processes and guidelines

Advice for the Technology Supplier/Services Provider

• What is needed for data-driven metrics
• The role of GRC platforms
• What the intelligence fabric provides
• What the fabric enables
  • Appropriate metrics by audience
    • Governance metrics
      • Audience
      • Categories and details
    • Managerial metrics
      • Audience
      • Categories and details
    • Operational metrics
      • Audience
      • Categories and details
  • Benefits

Learn More

• Related research
• Synopsis