Security has an awkward measurement problem: success looks like nothing happening. Waiting for an incident to find out whether your spend was adequate is not a strategy, so the useful metrics are leading indicators rather than outcomes.
1. Certificate expiry incidents
Start here because it is the most common self-inflicted outage in this category, and it is trivially measurable: how many times in the last year did a certificate expire before renewal?
The target is zero, and getting there is not about spending more. It is automation plus independent monitoring plus alerts going to a shared mailbox rather than one person's inbox. The usual root cause of an expiry is that the reminder went to someone who had left.
2. Patch latency
Days between a security update being released for something you run and it being applied. Measure it for the operating system, the application framework, the CMS and its plugins separately, because they are patched by different people on different rhythms.
This is the strongest single predictor of whether you get compromised. The overwhelming majority of small business site compromises exploit known vulnerabilities in unpatched software — not novel attacks. Reducing patch latency does more for your actual risk than any certificate upgrade.
3. Restore time, measured not estimated
How long to restore from backup, tested. Ransomware and destructive incidents are survivable if you can restore quickly and the backups are out of reach; they are existential if you cannot.
Test quarterly, write down the time, and note what was missing. That number is your real recovery position and it is usually worse than assumed.
4. Exposed surface
Count what is reachable from the internet that need not be: administrative interfaces open to any address, database ports listening publicly, old subdomains pointing at servers nobody maintains, staging environments indexed by search engines.
Review quarterly. Forgotten subdomains are a recurring finding — a marketing campaign site from three years ago, running an unpatched CMS, still resolving.
5. Access hygiene
- Accounts belonging to people who have left, still active
- Shared logins, which destroy accountability
- Administrative accounts without two-factor authentication
- Third parties with standing access that was granted for one project
Cheap to check, and consistently where incidents actually start.
Justifying spend without inventing numbers
Avoid quoting industry breach-cost averages. They are drawn from large enterprises and do not describe a small business, and a sceptical owner will discount the entire argument once they notice.
Use your own figures instead: hourly downtime cost multiplied by realistic recovery time, plus the value of data you could not reconstruct, plus what a customer data incident would cost you in obligations and relationships. Rough is fine. Yours is more persuasive than an average.
The quarterly review
- Certificate expiry incidents — target zero
- Current patch latency per layer
- Restore tested? How long?
- Exposed surface reviewed, forgotten subdomains removed
- Access list reviewed, departed users removed
An hour, four times a year. It addresses more real risk than most of what gets sold as security.
About the author. Kislay Chandan has worked with schools since 2014. Rather than gathering requirements from the outside, he worked inside a school to see what actually goes wrong day to day, and built what he found into the software. He still works with Shemrock Glitters in Patna — most changes to the product start with something that came up there.
Gallery
