51% of companies use a cybersecurity exposure score or risk-based index.

47% of companies use mean time to remediate as a cybersecurity metric.

41% of companies use percentage of exposures remediated as a cybersecurity metric.