Understanding the power of metrics and how to automate systems to deliver data that is useful should be the next step.

“I think the C-suite wants to see this kind of measurement, but I still think as an industry we need to grow a little bit to make sure we can get it to them in a way they can use it,” says Banks who puts on training programs for security organizations and always asks those who take his classes how many have an automated data collection system that allows them to collect and analyze information. Out of a group of 30 people if five put up their hand, he says he’s impressed.

“How can you establish metrics and ROI unless you have a process that allows you to track and analyze data and make decisions?”

When tracking incidents, Murphy says the best way is to have a system set up to send alerts and then you can start to see if a situation is getting better or worse.

At some point, not tracking incidents could become a detriment to your organization and your career.

“You can be liable if something is happening in your organization, and if there is a question that you could have known, you might be on the hook,” says McIlravey.