Use Outcome-Driven Metrics to Mediate GenAI Risks

Outcome-driven metrics (ODMs) translate the technical benefits of cybersecurity measures into language executives understand.

Outcome-driven metrics bridge the gap between cybersecurity and the C-suite

The relationship between the C-suite, board of directors and the cybersecurity function is like that between a car owner and a mechanic: The layperson knows they need the expert, but there’s often suspicion about whether the expert’s efforts are warranted. Outcome-driven metrics (ODMs) are designed to fill that knowledge gap. They provide visibility that allows a practical conversation, free from jargon, about how well the organization is protected from technology risk — like GenAI investments — vs. how it is protected.

ODMs help reframe cybersecurity in terms of business drivers (e.g., business operations, regulatory requirements, shareholder and customer satisfaction, partnerships, cyberinsurance eligibility, benchmarks and observable business impact). Managing cybersecurity risks thus becomes a business decision — the organization is either hitting its preset operational targets or is not — like every other business decision and investment.

Download the Security Technology and Infrastructure for Technical Professionals Primer

Implement practices and solutions to protect your organization’s critical assets.

By clicking the "Continue" button, you are agreeing to the Gartner Terms of Use and Privacy Policy.

Contact Information

All fields are required.

    Back

    By clicking the "Continue" button, you are agreeing to the Gartner Terms of Use and Privacy Policy.

    Company/Organization Information

    All fields are required.

    Optional

    Back

    By clicking the "Submit" button, you are agreeing to the Gartner Terms of Use and Privacy Policy.

    GenAI-associated cybersecurity risks warrant identifying outcome-driven metrics

    Before presenting to a board of directors or C-suite executives about GenAI risk exposures, formulate ODMs that demonstrate the performance of security controls to reduce GenAI-related security risks. 

    Establish GenAI-specific ODMs

    Partner with business leaders to establish GenAI ODMs in six categories:

    • GenAI use-case risk assessments show how much security processes help reduce the impacts of deploying high-risk use cases without proper risk assessment and treatment.

    • Data readiness demonstrates how prepared the organization is to use existing data assets in its GenAI applications and how secure they are.

    • GenAI application security showcases the protections in place over the organization’s in-house-developed GenAI applications.

    • GenAI quality assurance ensures GenAI applications are assessed to validate data quality through large-language-model (LLM) prompts to minimize bias and hallucinations.

    • Third-party cybersecurity risk management shows how well-protected the organization is from risks related to GenAI from vendors and other partners supporting its business value streams.

    • GenAI skills and training demonstrates the value of preparing employees for safely, securely and ethically developing and using commercial, off-the-shelf GenAI-enabled applications.

    Gartner for Technical Professionals (GTP) is a specialized service that provides in-depth technical research and insights tailored to the needs of IT professionals and architects who are tasked with implementing technical domain strategies. Talk to Gartner to learn more.

    Complement ODMs with Gartner’s TRiSM framework

    Gartner’s AI trust, risk and security management (TRiSM) is a set of solutions to proactively identify and mitigate AI-related risks. It helps organizations govern and manage AI models and applications throughout their life cycles — and achieve business goals. The TRiSM framework ensures organizations’ AI applications and models are reliable, trustworthy, secure and protect the data leveraged and produced. 

    AI TRiSM espouses six technical capabilities needed across all AI initiatives:

    • Data protection 

    • Content anomaly detection 

    • Application security 

    • Model management and model operations 

    • Explainability and transparency 

    • Adversarial resistance

    The framework aligns with the six ODM categories and provides insight into potential data sources for GenAI-associated ODMs.

    Negotiate protection-level agreements (PLAs) to support ODMs

    To be useful, ODMs must align to agreed-upon performance or protection levels. Without this alignment, an ODM is simply a data point without context that provides little insight into whether the outcome is good or bad.

    A PLA is a construct that facilitates cybersecurity decisions between executives and IT and security decision makers. It frames a business decision to invest in measurable levels of protection at a defined cost. 

    PLAs enable more effective business-led cybersecurity investment decision making by: 

    • Putting cybersecurity investment into a business context.

    • Balancing cost with protection levels.

    • Engaging business decision makers.

    • Establishing a concrete, measurable and enforceable expression of risk appetite and tolerance.

    • Replacing estimates of impact and likelihood with measurable, observable results.

    • Supporting the expression of security investments in a business or mission context.

    Engage executives with business-centric narratives

    Augmenting data points with business-centric narratives makes the insights ODMs provide relevant and actionable for board- and executive-level audience members. It also equips them to make effective, timely and defensible GenAI-related cybersecurity risk management and investment choices.

    Use cybersecurity value stories — compelling narratives with supporting metrics that clearly demonstrate how cybersecurity outcomes generate business value — to clarify how ODM data relates to your audience’s strategic objectives. Effective value stories:

    • Align with the business objectives outlined in the organization’s approved GenAI use cases.

    • Reflect the GenAI business and cybersecurity risk outcomes desired.

    • Are concise and easy to understand.

    • Are tailored to the audience’s priorities

    Outcome-driven metrics FAQs

    What are outcome-driven metrics?

    ODMs are operational metrics that provide a direct line of sight between the performance of security investments and business outcomes, and a clear indicator of how well the organization is safeguarding the data being leveraged and maximizing investment returns.

    What is the purpose of GenAI use case risk assessments?

    GenAI business use cases should augment, amplify or accelerate an organization’s multiyear strategy by increasing productivity, reducing cost, enhancing the customer experience, increasing business agility and improving profitability. Assess which risks are associated with each use case and how they could impact the organization in relation to factors such as business criticality, data sensitivity, customer impact, privacy and brand reputation. The outcomes of these risk assessments should inform security control design, development, implementation and operation of your GenAI initiatives.

    Drive stronger performance on your mission-critical priorities.