What goes in a cybersecurity executive dashboard in Metabase?

A cybersecurity executive dashboard is the translation layer between security operations and the board: a posture-score trend, incidents and near-misses, patch and vulnerability SLA attainment, program milestones, and spend against budget. It rolls up what the SOC and vulnerability management dashboards track operationally into the handful of numbers leadership actually governs with. Metabase builds it from monthly rollups of those same sources.

What does a cybersecurity executive dashboard look like?

Here’s the layout this guide builds. The quarter’s headline numbers open the page — posture score, open criticals, SLA attainment, incidents, spend — so a two-minute read exists; risk and incidents follow, pairing the score trend with its domain breakdown so the composite can’t hide a weak spot; program and investment close the page, because milestones and budget are where the executive conversation actually lands.

Which cards belong on a cybersecurity executive dashboard?

The eight below answer the four questions boards ask: are we getting safer, what happened, are we keeping our commitments, and what is the program delivering for the money?

• Security posture score — the composite, monthly, against the target (line)
• Posture score by domain — identity, endpoint, cloud, application, vendor (row)
• Incidents and near-misses per quarter — side by side, on purpose (bar)
• Open critical vulnerabilities — the monthly trend, not today’s count alone (area)
• Patch & vulnerability SLA attainment — against the commitment made to the board (line)
• Awareness-training completion by department — worst last, named (row)
• Security budget consumed — spend against the fiscal-year plan (progress)
• Security-program milestones — initiative, owner, status, due date (table)

What data does the dashboard need?

• A security_domain_scores table — month, domain, score — plus a posture_weights table holding the published formula.
• A monthly incident rollup with incidents and near_misses columns, classified by an explicit boundary rule.
• Monthly vulnerability rollups — open_criticals and sla_attainment_pct — from the scanner’s data, not hand-entered.
• A program_milestones table with initiative, owner, status, and due date; and training-completion records joined to HR headcount.
• Security cost-center actuals from the finance system, monthly, against the FY budget figure.

How do you build it?

1. Build one small monthly rollup model per domain — vulnerabilities, incidents, identity, training, spend — on top of the operational tables the SOC and vuln dashboards already use.
2. Define the posture score in data: domain metrics → domain score → weighted composite, with weights in a table so the formula is inspectable and versioned.
3. Record commitments as goal lines — the 95% SLA target, the posture target — so every trend chart carries the number leadership signed up to.
4. Keep the milestone table in the warehouse (or synced from the project tracker) with owner and status values from a closed list; it’s the card executives read first.
5. Add business-unit, security-domain, and date filters, then send a monthly subscription to the executive team and bring the live dashboard — not slides — to the quarterly review.

Example card SQL

WITH domain_scores AS (
SELECT
  s.month,
  s.domain,                        -- identity, endpoint, cloud, …
  s.score,                         -- 0–100, from that domain's metrics
  w.weight
FROM security_domain_scores s
JOIN posture_weights w USING (domain)
)
SELECT
d.month,
ROUND(SUM(d.score * d.weight) / SUM(d.weight), 0)  AS posture_score,
i.incidents,
i.near_misses,
v.open_criticals,
ROUND(v.sla_attainment_pct, 1)                     AS sla_attainment_pct
FROM domain_scores d
LEFT JOIN monthly_incident_rollup i USING (month)
LEFT JOIN monthly_vuln_rollup v USING (month)
WHERE d.month >= date_trunc('month', now()) - interval '12 months'
GROUP BY d.month, i.incidents, i.near_misses,
       v.open_criticals, v.sla_attainment_pct
ORDER BY d.month;

Related

Metrics

Integrations

Dashboards

FAQ