Cyber threats are evolving rapidly. Emerging technologies – AI, cloud, blockchain – are introducing complex vulnerabilities across the economy. Yet, most countries lack the data infrastructure to understand and respond effectively.

Without standardized metrics, governments and businesses operate in the dark, risking costly delays and fragmented responses, says the new report “Cyber metrics for key decision-makers”, published by Zurich together with the Cyber Threat Alliance and CyberGreen Institute.

The report notes the global cyber risk protection gap of USD 0.9 trillion, with insured losses covering only 1% of economic losses from cyber incidents.

According to the report, there is a distinct gap between the impact of the evolving cyber threat landscape on a country’s resilience, the insights drawn from current data collection, and the critical information still needed to address emerging challenges. To overcome this gap and help build a meaningful national cyber risk picture, the report suggests six core metrics that should be tracked:
 

1. Cyber insurance/audit certification coverage – percentage of covered organizations
2. Vulnerability exposure rates – percentage of exploited vulnerabilities older than one year
3. Significant cyber incidents – number of major breaches or attacks
4. Time to containment – average duration to isolate threats
5. Time to restore operations – mean time to full recovery
6. Unfilled cyber security positions – percentage of cyber security personnel vacancies

To move from currently fragmented, reactive approaches to a unified, data-driven strategy, Zurich calls on policymakers to:
 

• Collaborate on data collection: Move from reactive incident reporting to proactive, cross-sector data sharing
• Establish dedicated entities: Create or empower national and global institutions to collect, analyze, and report cyber statistics across industries and borders
• Harmonize standards and frameworks: Align definitions, benchmarks, and reporting protocols.

Establishing National Cyber Statistics Bureaus – dedicated institutions for collecting the above metrics – would ensure consistent incident reporting, track threats and resilience, publish key analyses, and assess security regulation effectiveness. These bureaus could also support a supra-national body to aggregate findings, enabling deeper global comparisons and insights into evolving threats, the report emphasized.

The full report can be found here.