An external asset count rises when discovery improves, the business grows or attribution becomes noisy. On its own, it says almost nothing about security performance.
Measure visibility confidence
Track validated coverage of known domains, address space and cloud footprints, plus the age and confidence of attribution evidence.
Measure ownership flow
Useful indicators include time to owner, percentage unowned, repeat discoveries and assets created outside approved processes.
Measure risk reduction
Track exposed high-risk services, known exploited vulnerabilities, unsafe administration interfaces and time to removal or mitigation. Separate new discovery from unresolved debt.
Practical next steps
- Publish a small outcome-focused metric set.
- Show trends with denominators and scope changes.
- Review the oldest unowned exposures.
- Connect recurrence to preventive engineering work.
Continue the decision