A ratio metric expresses one quantity as a proportion of another. Coverage figures, completion rates, share of findings closed inside a window. Most useful security metrics are ratios, because absolute counts scale with the size of the estate and stop being comparable across time or across organizations.
The numerator is usually obvious and usually correct. The denominator is where the judgement calls sit, and where a metric quietly becomes misleading.
Endpoint coverage is the standard example. Share of endpoints running a supported agent, expressed over what?
Over endpoints the agent management console knows about, the figure will be high, because the console only knows about endpoints where the agent installed successfully. It is close to a tautology.
Over endpoints in the asset inventory, the figure drops and becomes informative, assuming the inventory is complete.
Over endpoints discovered by network scanning plus inventory plus cloud APIs, the figure drops again and is the closest to honest.
Same numerator, three very different numbers, all defensible.
The denominator should be the population you actually care about, drawn from the most complete source available, not the population the numerator’s source happens to know about.
A ratio whose numerator and denominator come from the same system is usually measuring that system rather than the estate.
Small denominators produce unstable percentages. Two out of three is 67 percent and one incident away from 33. Publish the underlying counts alongside the ratio for any small population.
Exclusions accumulate silently. Every removal from the denominator improves the ratio. Record each one with a reason and review them. See metric definition.
Changing denominators break trends. When scope changes, the ratio moves without any change in the world. See baseline.
Always show the denominator. A coverage figure of 94 percent means something different at 200 assets than at 200,000, and a reader who cannot see which one is being shown half the metric.
From the blog