Table 13 Descriptives + 95% CI for mean by governance group (all principal metrics)

BF01

Breach frequency (incidents/year)

Compliance

34

2.40 (1.28)

[1.96, 2.84]

BF01

Breach frequency (incidents/year)

Framework

37

1.80 (0.82)

[1.53, 2.07]

BF01

Breach frequency (incidents/year)

Risk

28

1.20 (0.73)

[0.92, 1.48]

BF01

Breach frequency (incidents/year)

Exposure-driven

19

0.60 (0.41)

[0.40, 0.80]

IRR01

Incident recurrence rate (%)

Compliance

33

28.0 (10.7)

[24.2, 31.8]

IRR01

Incident recurrence rate (%)

Framework

36

22.0 (11.1)

[18.2, 25.8]

IRR01

Incident recurrence rate (%)

Risk

28

16.0 (9.3)

[12.4, 19.6]

IRR01

Incident recurrence rate (%)

Exposure-driven

18

10.0 (9.7)

[5.2, 14.8]

MTTD01

Mean time to detect (days)

Compliance

32

12.5 (6.0)

[10.4, 14.6]

MTTD01

Mean time to detect (days)

Framework

35

10.3 (5.2)

[8.5, 12.1]

MTTD01

Mean time to detect (days)

Risk

26

8.2 (4.5)

[6.4, 10.0]

MTTD01

Mean time to detect (days)

Exposure-driven

17

5.4 (3.4)

[3.7, 7.1]

MTTC01

Mean time to contain (days)

Compliance

32

6.8 (3.1)

[5.7, 7.9]

MTTC01

Mean time to contain (days)

Framework

34

5.7 (2.7)

[4.7, 6.7]

MTTC01

Mean time to contain (days)

Risk

26

4.6 (2.8)

[3.5, 5.7]

MTTC01

Mean time to contain (days)

Exposure-driven

16

3.2 (2.1)

[2.0, 4.4]

MTTR01

Mean time to remediate (days)

Compliance

33

9.8 (4.3)

[8.3, 11.3]

MTTR01

Mean time to remediate (days)

Framework

35

8.7 (3.9)

[7.4, 10.0]

MTTR01

Mean time to remediate (days)

Risk

27

7.4 (3.2)

[6.1, 8.7]

MTTR01

Mean time to remediate (days)

Exposure-driven

17

5.6 (2.7)

[4.2, 7.0]

EFF01

Analyst effort per incident (hours)

Compliance

30

22.0 (10.3)

[18.0, 26.0]

EFF01

Analyst effort per incident (hours)

Framework

33

18.0 (8.8)

[14.9, 21.1]

EFF01

Analyst effort per incident (hours)

Risk

25

15.0 (8.2)

[11.6, 18.4]

EFF01

Analyst effort per incident (hours)

Exposure-driven

16

11.0 (6.1)

[7.7, 14.3]

SLA01

SLA compliance (%)

Compliance

31

72.0 (11.9)

[67.7, 76.3]

SLA01

SLA compliance (%)

Framework

34

78.0 (10.1)

[74.5, 81.5]

SLA01

SLA compliance (%)

Risk

26

84.0 (9.3)

[80.2, 87.8]

SLA01

SLA compliance (%)

Exposure-driven

18

92.0 (5.9)

[89.1, 94.9]

VIS01

Exposure visibility (0–100)

Compliance

35

55.0 (12.2)

[50.8, 59.2]

VIS01

Exposure visibility (0–100)

Framework

37

63.0 (11.5)

[59.2, 66.8]

VIS01

Exposure visibility (0–100)

Risk

28

71.0 (9.2)

[67.4, 74.6]

VIS01

Exposure visibility (0–100)

Exposure-driven

19

83.0 (8.7)

[78.8, 87.2]

AUTO01

Automation coverage (0–100)

Compliance

34

48.0 (14.1)

[43.1, 52.9]

AUTO01

Automation coverage (0–100)

Framework

37

58.0 (13.0)

[53.7, 62.3]

AUTO01

Automation coverage (0–100)

Risk

28

66.0 (12.3)

[61.3, 70.7]

AUTO01

Automation coverage (0–100)

Exposure-driven

18

79.0 (10.0)

[74.2, 83.8]

TI01

Threat intelligence use (0–100)

Compliance

33

46.0 (15.4)

[40.5, 51.5]

TI01

Threat intelligence use (0–100)

Framework

36

55.0 (13.8)

[50.3, 59.7]

TI01

Threat intelligence use (0–100)

Risk

27

62.0 (12.7)

[56.9, 67.1]

TI01

Threat intelligence use (0–100)

Exposure-driven

18

74.0 (11.2)

[68.6, 79.4]

KRI01

KRI usage in decisions (0–100)

Compliance

33

42.0 (16.3)

[36.2, 47.8]

KRI01

KRI usage in decisions (0–100)

Framework

35

52.0 (14.9)

[46.9, 57.1]

KRI01

KRI usage in decisions (0–100)

Risk

27

60.0 (13.1)

[54.7, 65.3]

KRI01

KRI usage in decisions (0–100)

Exposure-driven

18

73.0 (10.8)

[67.8, 78.2]

CONF01

Stakeholder satisfaction (Likert 1–5)

Compliance

34

3.10 (0.78)

[2.83, 3.37]

CONF01

Stakeholder satisfaction (Likert 1–5)

Framework

37

3.40 (0.70)

[3.17, 3.63]

CONF01

Stakeholder satisfaction (Likert 1–5)

Risk

27

3.80 (0.66)

[3.54, 4.06]

CONF01

Stakeholder satisfaction (Likert 1–5)

Exposure-driven

18

4.30 (0.58)

[4.02, 4.58]