Notifications
Clear all
Topic starter
01/08/2026 10:42 pm
TL;DR: Security champion programmes should be judged on engagement, issue reporting, bug reduction, and team impact rather than vanity clicks, according to Semgrep, because those signals show whether the programme changes behaviour and improves outcomes. The practical lesson for identity teams is that useful metrics must prove governance value, not just activity.
NHIMG editorial — based on content published by Semgrep: Security Metrics That Matter
By the numbers:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How do security and data teams know whether governance controls are actually working?
A: They should test whether metadata changes, ownership updates and discovery signals are reflected consistently across both the governance platform and the cloud environment.
Q: Why are engagement metrics often misleading in security programmes?
A: Because engagement only proves that people showed up, clicked, or attended.
Q: What metrics should identity teams track beyond completion rates?
A: Track issue recurrence, entitlement reduction, stale account cleanup, ownership coverage, and time to remediation.
Practitioner guidance
- Replace activity counts with control-effect metrics Track whether the programme reduced repeated findings, shortened remediation time, and lowered exception volume.
- Measure recurrence, not just participation Count how often the same issue reappears after a champion intervention or identity review.
- Tie reports to a specific risk class Choose one bug or identity risk class and monitor how often it is found, fixed, and reintroduced.
What's in the full article
Semgrep's full article covers the practical metric ideas this post intentionally leaves at a higher level:
- Examples of security champion KPIs that map to real engineering outcomes rather than traffic.
- Ways to use bug tracker data to show whether a specific bug class is actually declining.
- The distinction between useful reporting for management and misleading vanity metrics.
- Story-based reporting techniques that help translate programme impact for leadership.
👉 Read Semgrep's article on security champion metrics that matter →
Security champion metrics: what teams should actually measure?
Explore further
01/08/2026 10:52 pm
Security measurement fails when teams confuse visibility with control. This article makes the classic point that activity is not proof of effectiveness. In identity programmes, the same mistake appears when teams celebrate review completion or audit closure without checking whether privilege sprawl, stale access, or secret exposure actually improved. The practitioner conclusion is simple: if the metric cannot show change in the control state, it should not drive decisions.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs , Key Research and Survey Results.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs , Key Research and Survey Results.
A question worth separating out:
Q: How do organisations avoid vanity metrics in access governance?
A: Start with the security outcome you want, then choose metrics that prove whether the control changed reality. For example, measure revoked access, reduced exceptions, and repeated finding rates instead of only counting reviews completed. That approach gives leadership evidence they can use and tells the team where the programme still fails.
👉 Read our full editorial: Security champion metrics that matter beyond vanity clicks
