Skip to main content

Metrics Tracker

The Metrics Tracker monitors your organization's cyber resilience across five metrics: Upskilling Engagement, Threat Response, OWASP Completion, Coding Language Skills, and MITRE ATT&CK Coverage. It lets you benchmark against industries, review progress over time, and drill down to team-level data.

Overview

The Metrics Tracker helps you track how your organization is performing across cyber resilience metrics, and lets you benchmark your scores against other industries.

The following metrics are available:

  • Upskilling Engagement.
  • Threat Response.
  • OWASP Completion.
  • Coding Language Skills.
  • MITRE ATT&CK Coverage.

Who the metrics are designed for and who can view them

These metrics are designed for a senior-level audience who can use this information to:

  • Monitor performance and review progress to date across the organization.
  • Demonstrate the impact and return on investment of using Immersive.
  • Understand change over time and compare against industry benchmarks.
  • Identify gaps, prioritize focus areas, and track progress over time, drilling down into teams and individuals where needed.

All managers and organization admins can view the organization-wide metrics, but the extent to which you can see more detailed data for each metric depends on your role.

  • Organization admins can view all breakdown data and any recommended actions.
  • Team managers can only view breakdown information specific to the teams and users they manage under the relevant metrics.
  • Crisis simulation managers and workforce managers can only view the overarching metrics — they can't view detailed data for each metric.

Accessing the Metrics Tracker

To access the Metrics Tracker:

From the main navigation menu, click Reports > Metrics Tracker.

Using the Metrics Tracker

To use the Metrics Tracker:

  1. From the Benchmark against drop-down list, select one of the following options:
    • All Industries
    • Financial Services
    • Technology
    • Consulting
    • Manufacturing
    • Best in Class
  2. See Benchmark groups and how they are calculated for more information.
  3. From the left-hand panel, click the desired report:
    • Upskilling Engagement (listed under Security Teams) – tracks platform usage (excluding cyber ranges) by cyber professionals with an Immersive Labs license. See The Upskilling Engagement metric for more information.
    • Threat Response (listed under Security Teams) – tracks engagement with cyber threat intelligence labs published in the last six months. See The Threat Response metric for more information.
    • OWASP Completion (listed under Developers) – tracks engagement with the OWASP Top 10 lab collection by each software developer. See The OWASP Completion metric for more information.
    • Coding Language Skills (listed under Developers) – tracks developers' progress in their primary programming languages. See The Coding Language Skills metric for more information.
    • MITRE ATT&CK Coverage (listed under Security Teams) – tracks coverage of MITRE ATT&CK techniques and subtechniques by cyber professionals with an Immersive Labs or Cyber Range Exercising license. See The MITRE ATT&CK Coverage metric for more information.
  4. Note: If you don't have any data yet, a message appears explaining that there is currently no data available to view.
  5. Review your results:
    • For each metric, you can download a CSV file with your results.
    • You can filter metrics by month and year.

Benchmark groups and how they are calculated

For sector-specific benchmark groups, scores are based on the 75th percentile for that group. This lets you benchmark against high-performing organizations in your sector and avoids scores being skewed by organizations with low results. The All Industries benchmark group score is also based on the 75th percentile across all organizations. The Best in Class benchmark group is based on the 99th percentile of all organizations.

The Upskilling Engagement metric

This metric focuses on engagement with lab content by Immersive Labs licensed users. It measures the relative regularity and completion of lab content.

There are two types of designations in this report: one for completion within the last six months (regularity of completion), and one for completion of at least 10 labs (amount completed).

For completion within the last six months:

  • A high engagement designation appears if 80% or more of users have completed lab content within the last six months.
  • A moderate engagement designation appears if more than 40% but fewer than 80% of users have completed lab content within the last six months.
  • A low engagement designation applies if 40% or fewer of users have completed lab content within the last six months.

For completion of at least 10 labs:

  • A high completion designation appears if 75% or more of users have completed at least 10 labs.
  • A moderate completion designation appears if more than 25% but fewer than 75% of users have completed at least 10 labs.
  • A low completion designation appears if 25% or fewer of users have completed at least 10 labs.

The Threat Response metric

This metric focuses on a combination of speed and degree of completion of threat labs by users with an Immersive Labs license.

The metric combines how quickly users completed a threat lab after it was published and how many users completed it, based on all threat labs published within the last 180 days.

There are two types of designations in this report: one for average response time for completion of threat labs, and one for how many labs have been completed by at least five users.

For average response time:

  • A slow response time designation appears if average completion is 30 days or more.
  • A medium response time designation appears if average completion is more than seven days but fewer than 30 days.
  • A fast response time designation appears if average completion is seven days or fewer.

For completion of labs by at least five users:

  • A high completion designation appears if five or more users have completed 75% or more of threat labs within a week of publication.
  • A moderate completion designation appears if five or more users have completed more than 25% and fewer than 75% of threat labs within a week of publication.
  • A low completion designation appears if five or more users have completed 25% or fewer of threat labs within a week of publication.

Note: The threat lab category started in 2020, so no data is available prior to this date. This metric also includes users who may no longer be licensed to your organization, due to the focus on speed of response at a particular point in time. Labs that have only been completed by a single user within your organization are identified within the Recommended Focus Areas section of the report (currently accessible to organization admins only, due to the potential inclusion of individuals from any team). Scores in this metric may be affected if labs are removed from the threat lab category at a later date, although this will be minimized wherever possible.

The OWASP Completion metric

This metric focuses on users identified as software developers within the platform, based on license type or self-attestation of role. Users are included if they have self-identified as a software developer in the platform and have an Immersive Labs or Immersive Application Security license, or if they have not self-identified but have an Immersive Application Security license.

The metric measures the percentage completion of the OWASP Top 10 lab collection by each software developer.

Note: Completion of the Demonstrate lab in this collection counts as 100% completion. If the Demonstrate lab is not completed, the score reflects the percentage of labs in the collection that have been completed. This metric includes developers who haven't completed any labs within this collection, and is an average of all software developers' scores.

  • A high completion designation appears if 75% or more of software developers have completed the whole collection.
  • A moderate completion designation appears if more than 25% but fewer than 75% of software developers have completed the whole collection.
  • A low completion designation appears if 25% or fewer of software developers have completed the whole collection.

Note: This metric only provides scoring from November 2021 onwards, when the OWASP Top 10 collection was published on the platform. Self-attestation of role was also introduced in 2022, so you may see an uptick or change in score around that time. Scores may also be affected by changes to the number of labs within the current OWASP Top 10 collection — for example, if a new lab is published to this collection or an existing lab is removed or archived. This will change current scores, but won't change historical scores.

The Coding Language Skills metric

This metric focuses on users identified as software developers within the platform, based on license type or self-attestation of role, and an inference of primary coding language based on the labs they've completed. Users are included if they have self-identified as a software developer in the platform and have an Immersive Labs or Immersive Application Security license, or if they have not self-identified but have an Immersive Application Security license.

The metric measures the percentage of labs each software developer has completed in their primary language, capped at 10 labs, where 10 labs equals a score of 100%. Completing 10 labs is considered applicable across the majority of language-specific content that Immersive currently provides. This metric includes developers who haven't done any language labs, and is an average of all software developers' scores.

  • A high completion designation appears when 75% or more of software developers have completed some language-specific content.
  • A moderate completion designation appears when more than 25% but fewer than 75% of software developers have completed some language-specific content.
  • A low completion designation appears when 25% or fewer of software developers have completed some language-specific content.

Note: Self-attestation of role was introduced in 2022, so you may see an uptick or change in score around that time. Scores may also be affected by changes to the language tags of published labs — for example, removal or archiving of currently tagged labs, or changes to language tags on published labs. This will be minimized wherever possible, but may affect both current and historical scores.

The MITRE ATT&CK Coverage metric

A technique score is determined for each technique in the MITRE ATT&CK framework. This score is made up of two factors:

  • Breadth of coverage – the proportion of subtechniques covered within that technique, meaning whether content related to each subtechnique has been completed.
  • Depth of coverage – the number of users who have covered each subtechnique, meaning how many users have completed content related to each subtechnique (capped at 10 users for the highest possible score).

This metric represents the average technique score, considering only those with mapped platform content.

There are two call-outs for this metric.

The number of techniques that have every subtechnique covered by your organization:

  • Good – 75% or more of techniques.
  • Moderate – more than 25% but fewer than 75%.
  • Low – 25% or fewer.

The number of techniques that have more than five people covering each of its subtechniques:

  • Good – 70% or more of techniques.
  • Moderate – more than 20% but fewer than 70%.
  • Low – 20% or fewer.

Note: Changes to data models in 2022 mean the MITRE metric only shows data from January 2022 onwards. As with all metrics in the Metrics Tracker, this metric includes data from both assigned and self-directed learning. Only content mapped to the MITRE ATT&CK Framework is included. Only users with an Immersive Labs license who are licensed during the chosen time period are included. For example, if a user is licensed in January and February but not in March, they won't be included in the metric value from that point, which may affect your technique coverage scores.

How the MITRE ATT&CK metric differs from the current MITRE ATT&CK framework heatmap

The existing MITRE ATT&CK framework heatmap only includes completion of relevant lab content.

If you have a license for Cyber Range Exercising, the MITRE ATT&CK metric includes completion of both relevant lab content and relevant Immersive-created Cyber Range Exercises. If you don't have Cyber Range Exercising, this metric only includes completion of relevant lab content.

There are also some differences in the underlying calculations. The current heatmap shows your organization's relative coverage of different techniques within the framework, showing areas where your coverage is comparatively higher or lower.

This metric takes a different approach. It defines a target level of coverage applicable to all organizations, then assesses how your organization's coverage aligns with that benchmark.

How to drill down to see data at the team level

You can drill down within the breakdown section to view team and individual information for users and teams you manage. Currently, you can only view the metric itself at the organization level.

Changes to historical metric scores

Historical metric scores may be affected by changes to an organization's licenses or users — for example, if user data is removed from the platform following a deletion request. This isn't expected to happen frequently. Metric-specific changes that may occur are listed in the detail section for each metric.