WEEK 42 · GOVERNANCE

Rewrite one metric as the protection level the business is buying.

Outcome-driven metrics turn a security report into a purchase decision the business has to sign.

Submitted by Neil Watkins

October 10, 2026

Security metrics tell leadership how busy we were, and almost never what they bought.

Every planning cycle, security walks in with the same kind of numbers. Patch compliance, open criticals, click rate, mean time to respond. They're accurate, they trend roughly the right way, and they describe the work instead of the value. Leadership nods, funds about what it funded last year, and the conversation about what the business actually gets for its money never starts.

What I want to show is the business value, in real terms, not just risk. That comes up in the planning process, in strategy, in every initiative that needs funding, and most recently in a QBR with my own team.

The model I keep coming back to is Paul Proctor's outcome-driven metrics, and the credit for the idea is his. An ODM measures the protection you deliver. A protection level objective draws the line. The protection level agreement is where the business signs for that line, with a budget attached and a name next to it.

Take patching, with illustrative numbers so the shape is easy to see. The traditional report hands leadership a compliance percentage. The ODM measures elapsed days from patch release to deployment across tier-1 internet-facing infrastructure. The PLO says criticals and highs get remediated within 14 calendar days of public exploit availability. The PLA says leadership funds a dedicated automated patch-testing environment at $350k a year to hold those 14 days, and the business accepts the 0 to 14 day window as the cost of doing business.

The useful part shows up when somebody wants the money back. Cut $150k from that environment and the agreement doesn't quietly absorb the cut and hope. The threshold moves to 30 days, and the business formally accepts 16 more days of exposure, in writing.

Nobody in that room gets to say security failed to patch fast enough. The business bought 30 days.

Most of us learned that a metric exists to prove security is doing its job. That is the least useful thing a metric can do. Put it to work making the business choose its protection level out loud, at a price, and the risk debate turns into a purchase decision, which is the one kind of decision every executive already knows how to make.

Expect pushback, and expect it to be honest. Leaders and teams will resist, mostly because this is not the industry normal. Most of them want it. They just don't understand it yet, and nobody has shown them a finished one.

So, here's the MondayMove

Pick one metric from your last leadership report and write the protection level agreement behind it: what you measure, where the line sits, what it costs to hold that line, and what the business accepts if it stops paying.

Bring it to your next planning conversation and let the business choose.

Friday Follow-Up

The First PLA Will Look Like an SLA

Where I expect this week's move to break, and the one question to add before you take it to anybody.

Submitted by Neil Watkins

October 16, 2026

MondayMove gives you one concrete action every Monday. FridayFollowUp closes the loop.

Each Friday, a short dispatch on what practitioners actually found when they ran the week's move: where they got stuck, what surprised them, and what to do next. Not sanitized case studies. Field notes. Practitioner to practitioner.

This week's move was one metric from your last leadership report, rewritten as the protection level agreement behind it. Here is where I expect it to break.

The first draft will look like an SLA with a dollar sign stapled to it. You'll start from the number you already report, time to contain or a patch window, and the measure will stay a response clock because that is the only shape the data in your ticketing system knows how to take. If your ODM still describes how fast your team moved, keep going. It has to describe the protection the business holds.

Pricing the line is where I expect most people to stall. Very few of us know what one threshold costs, because the money sits in pooled budgets, a platform license covering six controls, an analyst splitting time across four queues. Estimate it anyway. A rough price the business can argue with beats a precise metric nobody can buy.

The service owner will try to hand the threshold back to you. Expect the polite version, something like "you're the experts, you tell us," and recognize it for what it is, because a PLO security picks alone is just an SLO with a new label.

Somebody on your own team will ask whether the SLAs go away. They don't. The response clocks still run the operation, and your vendors still owe you every minute in the contract. The PLA sits above them and tells the business what all those clocks add up to, which is a question the SLAs were never built to answer.

The money question will stall in one direction more than the other. Writing what more money buys feels like a pitch, and that part comes easy. Writing what less money costs feels like a threat, so people soften it or skip it, and the softened version is the one that comes back to bite you in the postmortem. Write the cut version with the same precision as the increase.

For next week, add the other column. Take the PLA you wrote and put two versions next to it, one with more funding and one with less, each with the protection level it buys in terms the business understands. Then take all three to the service owner and ask which one they're signing.

Keep going. See what a week can do.

No correct answers here. This is practitioner-to-practitioner. The more honest the responses, the more useful this gets for everyone reading on Monday morning.

See you then.

Discussion