Operational intelligence: is the organization actually getting safer?
Security spending is easy to measure. Whether that spending makes the organization safer is much harder to show. A telecommunications group asked us to answer that question from three years of its own test results.
48
31
17
Recurring-issue rate · exposure delta · MTTR · SLA adherence, per unit, per quarter
The question from the top
The group had five subsidiaries and three years of penetration test reports (write-ups of authorized, controlled attacks on its systems). Its senior leadership kept asking the same thing: “We are spending more. Are we safer?” Nobody could say, because each report stood alone as a separate PDF and nothing tracked progress between them.
Turning separate reports into a trend
We gathered every finding from those three years and grouped repeats of the same problem together. That let us sort issues into families, such as login weaknesses, injection flaws, misconfigurations, exposed secrets and missing patches.
We then tracked a small set of measures for each unit and each quarter:
- How many critical and high findings were open, and how long they had been open
- Whether the number of internet-facing systems was growing or shrinking
- How long fixes took on average (mean time to remediate, or MTTR), overall and by unit
- How often fixes met the agreed deadline, and how often they passed a retest
- Which teams, templates or code patterns kept bringing back the same kind of flaw
The client now receives this as a quarterly trends pack and a live dashboard.
What the trends revealed
In the first two quarters we analyzed, 71% of findings were repeats traced to five root causes. These were a shared login page template with a cross-site scripting flaw, a standard server image that lagged on patches, a cloud storage policy copied between projects, an insecure default in a one-time-password library, and a vendor’s VPN template.
One subsidiary accounted for 52% of critical findings while holding only 18% of the group’s assets, which gave leadership a clear place to focus coaching. We also found that the number of internet-facing systems had grown by 22%, largely from short-lived promotional websites. The vulnerability count was falling, yet overall risk was flat. That only became visible once exposure was factored in.
What changed
The group fixed the five shared templates at the source, which stopped the same classes of flaw from coming back each quarter. Subsidiaries now see internal scorecards, published to encourage improvement rather than to assign blame. The board now tracks two measures, how often old problems return and how much risk each unit carries relative to its exposure, in place of raw vulnerability counts.
Groups that see the same findings return quarter after quarter usually have a shared template or default at the root, and the trend data is how you find it.