Key performance indicators (KPIs) can be used in application security testing to measure the effectiveness of security testing and provide insight into the security posture of an application. Their purpose is to provide visibility into the effectiveness of an organization's application security testing program and to help identify areas for improvement. In a recent IDC survey (paywall) of mid-sized to large-sized software organizations, DevSecOps decision-makers identified the following as their top three KPIs for product security:
1. Vulnerability statistics
2. Compliance time and cost
3. Software build failures and delays
Let's consider each of these in more detail.