How to Measure and Benchmark Cybersecurity Skills

Measuring cybersecurity skills means evidencing what your people can actually do — the knowledge, skills, and judgment they apply when facing a real threat — rather than recording what they have attended or completed. Benchmarking those skills means comparing that evidence against a meaningful reference point: a starting baseline, the expectations of each role, recognized frameworks such as MITRE ATT&CK and the NICE Framework, industry peers, and your own performance over time.

For security leaders, the goal is a defensible, data-backed answer to a single question: are my people — from the SOC and development teams through to the executive committee and board — genuinely ready to respond to a severe but plausible cyber incident? This guide sets out what to measure, how to measure it, and how to benchmark the results so that capability becomes provable rather than assumed.

KEY FACTS

• Measuring cyber skills evidences demonstrated capability — the knowledge, skills, and judgment people apply in realistic conditions — not course completion or self-reported confidence.
• Benchmarking compares that capability against five reference points: a baseline, role expectations, security frameworks, industry peers, and progress over time.
• The most reliable signals come from hands-on performance in realistic labs and exercises, not completion rates, certifications held, or annual tabletop “passes”.
• A complete program measures individuals, teams, and the whole organization — from technical specialists through to the board.
• Immersive One captures workforce capability as performance data and expresses it as a single Resilience Score.

What does it mean to measure cybersecurity skills?

Measuring cybersecurity skills is the practice of assessing an individual's or team's demonstrated ability to perform security-relevant tasks and make sound decisions under realistic conditions. A robust measure captures three dimensions: knowledge (what someone understands), skills (what they can execute hands-on), and judgment (the decisions they make when information is incomplete and time is short).

This is distinct from tracking activity. Completion of an awareness module, hours logged, or certifications held describe what someone has been exposed to — not what they can do when an incident unfolds. Demonstrable performance is the unit of measurement that stands up to scrutiny from a board, a regulator, or a post-incident review.
‍

‍“It can be the hardest thing to measure and quantify — how good your technical team is. It's all too easy to get distracted on process and tech, because that's easier to measure. So start with your people.” — Dan Potter, Senior Director of Cyber Drills and Resilience, Immersive

‍

Why measuring and benchmarking cybersecurity skills matters

Most organizations operate with a confidence–capability gap: leaders believe their teams are ready, but lack the evidence to prove it. In research commissioned by Immersive, 80% of cyber leaders said they did not think — or were unsure — that their teams had the capabilities to respond to future attacks. Immersive's own benchmarking of workforce performance has repeatedly found that confidence outruns measured ability.

• Proof to stakeholders. Boards, auditors, regulators, insurers, and — in the worst case — courts increasingly expect evidence that an organization took all reasonable steps to prepare its people. Completion statistics do not provide it.
• Smarter investment. Measurement shows where capability is strong and where it is weak, so finite time and budget are spent on the gaps that matter rather than being spread evenly.
• A skills-based workforce. Forrester's Security Survey, 2025 found that 87% of decision-makers hiring cybersecurity practitioners consider it important to prioritize demonstrable skills — a shift away from point-in-time certifications toward proven capability.

‍

“I can show 95% of staff completed something on time; therefore, we must be secure. That's just not good enough against today's threat environment.” — Dan Potter, Immersive

‍

What to measure: the dimensions of cyber capability

Effective measurement looks across three levels and two types of capability.

Three levels:

• Individual — can a person perform the tasks their role demands?
• Team — can a function, such as the SOC or an incident response team, coordinate, triage, and escalate effectively?
• Organizational — can technical and business teams work together through a full incident, including executive decision-making and communications?

Two types of capability:

• Technical skill — detection, investigation, malware analysis, secure coding, threat hunting, and the hands-on work of defense and response.
• Judgment and decision-making — how individuals and leaders make decisions under pressure, escalate appropriately, and understand their role relative to others.

Capability should be measured in role and context. A SOC analyst, an application developer, an OT engineer, and a board member each need different skills, and each should be measured against expectations relevant to them.

How to measure cybersecurity skills: a step-by-step approach

1. Establish a baseline. Begin with an assessment that captures where individuals and teams stand today. A baseline makes every later measurement meaningful by giving you a point of comparison.
2. Define role-based expectations and map to frameworks. Set out what “good” looks like for each role and align it to recognized frameworks such as MITRE ATT&CK and the NICE / NIST workforce framework, so measurement is anchored to a shared standard.
3. Capture performance, not completion. Use hands-on labs and realistic, scenario-based exercises that require people to actually perform tasks. The data point is how they performed — accuracy, speed, and the quality of decisions — not whether they finished.
4. Exercise teams together. Run connected cyber drills that bring technical teams, leadership, and the board into the same scenario. This is the only way to measure coordination, escalation, and decision-making across the organization rather than in isolation.
5. Quantify into a comparable measure. Translate performance data into a consistent measure of capability so results can be tracked and compared across people, teams, and time.
6. Benchmark the results. Compare capability against the baseline, role expectations, frameworks, peers, and prior performance (see the next section).
7. Close gaps and re-measure continuously. Use the results to signpost targeted upskilling, then measure again. Capability is not a one-off audit; the threat landscape and your workforce both change constantly. This is the Prove → Improve → Be Ready cycle.

How to benchmark cybersecurity skills

Benchmarking cybersecurity skills means comparing measured capability against a reference point so that a raw result becomes meaningful. There are five reference points worth using together:

• Against a baseline — progress from your own starting position over time.
• Against role expectations — how each person or team performs relative to what their role requires.
• Against frameworks — coverage and depth relative to standards such as MITRE ATT&CK and the NICE Framework.
• Against peers and industry — how your organization compares to others of similar size or sector.
• Across internal teams — relative strengths and weaknesses between functions, so attention goes where it is needed.

‍

“You can prove where they're at, benchmark their capability relative to peers, and show how over the next six months, 12 months, three years they need to improve and upskill.” — Dan Potter, Immersive

‍

Metrics that matter — and the vanity metrics to retire

Not all measurements are equal. The metrics that survive scrutiny describe demonstrated ability; the ones that mislead describe activity or perception. The table below maps common vanity metrics to more reliable, capability-based alternatives.

‍

‍

Immersive One is a single platform for proving, improving, benchmarking, and reporting workforce cyber resilience — built on actual performance data rather than completion percentages. It measures and benchmarks capability across the whole organization:

• Hands-on Labs measure individual technical skill across defensive, offensive, application security, cloud, and OT domains.
• Cyber Range exercises measure whether technical teams can detect, investigate, and respond to realistic, team-based scenarios.
• Crisis Simulations measure how leaders and executives make decisions in high-stakes incidents.
• Cyber Drills connect technical and business teams in a single exercise so coordination and escalation can be measured end-to-end.
• The Resilience Score expresses all of this as a single value that quantifies workforce cyber resilience, lets you compare performance against peers and industry, identify gaps over time, and measure alignment to frameworks such as MITRE ATT&CK.

The business case for treating capability as measurable is well established. A 2026 Forrester Total Economic Impact™ study commissioned by Immersive found that a composite organization deploying Immersive One realized a 327% return on investment and $2.2M in net present value over three years — driven in part by the ability to track skills attainment, map capability to frameworks, and report real performance data to the business and its regulators.

To see how your organization can measure and benchmark cyber capability, request a demo of Immersive One.

‍

“An immersive cyber drill gives you the data points to show where you've got weaknesses, where you've got strengths — and where you need to focus your time on upskilling individuals and teams.” — Dan Potter, Immersive

‍

Frequently asked questions

How do you measure cybersecurity skills?

You measure cybersecurity skills by assessing demonstrated performance — what individuals and teams can actually do under realistic conditions — rather than recording course completion or self-reported confidence. The most reliable approach uses hands-on labs and scenario-based exercises that capture accuracy, speed, and decision quality, scored against role-based expectations and recognized frameworks such as MITRE ATT&CK and the NICE Framework.

What is the difference between measuring and benchmarking cybersecurity skills?

Measuring capture capability — what a person or team can do. Benchmarking compares that measurement against a reference point: a baseline, role expectations, security frameworks, industry peers, or past performance. Measurement tells you where you are; benchmarking tells you what that result means.

Why are training completion rates not a good measure of cyber skills?

Completion rates record activity, not ability. A high completion rate shows that people attended, not that they can detect an intrusion, contain an incident, or make the right call under pressure. Leaders are easily reassured by a statistic such as “95% completed on time”, which says nothing about real readiness.

Which frameworks can you benchmark cybersecurity skills against?

Common reference points include MITRE ATT&CK for adversary tactics and techniques, and the NICE Framework (NIST SP 800-181) for cybersecurity workforce roles and tasks. Benchmarking capability against these frameworks shows the breadth and depth of coverage relative to a recognized standard.

How often should you measure cybersecurity skills?

Continuously, rather than once a year. Threats evolve, technology changes, and people move in and out of roles, so a single annual exercise quickly goes stale. Regular, role-relevant measurement keeps the picture current and supports a cycle of proving, improving, and staying ready.

What is a Cyber Resilience Score?

A Resilience Score is a single value that quantifies an organization's cyber workforce resilience, based on performance data across skills, exercises, and real-world scenarios. It lets leaders monitor improvement over time, identify gaps, compare against peers and industry, and demonstrate that cyber capability is measurable rather than abstract.

How do you measure the cybersecurity skills of non-technical staff and executives?

Non-technical staff and executives are measured on judgment and decision-making rather than technical execution — for example, through crisis simulations that present realistic, high-pressure scenarios and capture the quality and speed of the decisions they make. This extends measurement beyond the SOC to the wider workforce and the board.

‍