Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics

A dashboard full of green indicators can still describe an insecure organization. Aram Hovsepyan, founder and CEO of Codific and an OWASP SAMM contributor, explains why vulnerability totals and unexamined CVSS scores often measure activity instead of security outcomes. He introduces the Goal Question Metric framework as a way to begin with an organizational goal, ask what must be understood, and choose measurements that answer those questions. Aram and the hosts distinguish precision, reliability, and accuracy, examine how metrics shape behavior, and identify overlooked indicators that show whether a program is actually moving. They also discuss redesigning executive dashboards and testing a long-standing metric from Chris. The takeaway: a useful metric must support a decision, reflect context, and make its limitations visible.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term, measurable results.
→ Learn more about Security Journey

Connect with Aram Hovsepyan:
→ Aram Hovsepyan on LinkedIn
→ Codific

Mentioned in this episode:
→ Goal Question Metric framework
→ LINDDUN
→ Codific
→ OWASP SAMM
→ Kim Wuyts
→ Security Compass
→ Toreon

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why your security dashboard may be lying
01:25 Meet Aram Hovsepyan
02:43 From privacy research to AppSec
06:30 The inspiration behind the talk
09:44 How common security metrics fail
11:35 If every metric is green, are you secure?
13:23 Metrics drive human behavior
16:48 Introducing Goal Question Metric
18:38 Precision, reliability, and accuracy
22:05 Good numbers can answer the wrong question
26:43 Why total vulnerability counts mislead
28:30 The metrics teams overlook
31:52 Measuring movement, not perfection
33:13 Redesigning a security dashboard
35:04 Testing Chris's long-standing metric
38:22 What a useful metric must reveal
40:09 Closing thoughts