How do security professionals measure their success?

Question

How do security professionals measure their success and how do they communicate this to others in their organizations? The way I see it, if no security incidents occur then either the security team is doing a good job, there was no threat to begin with, or it's only a matter of time before an incident does occur. If a security incident occurs, then clearly the security team has failed. It seems like workers in security are in a lose-lose situation: having to justify their existence when times are good or explaining why they performed their jobs to a reasonable standard when things go wrong. Is this really how it is?

Answer 1

As a security captain, I would not measure success only by whether an incident occurred. Security teams cannot prevent every incident, and a quiet shift does not always tell us whether our procedures worked.

I look at both prevention and response: Were patrols and site checks completed? Were hazards identified and reported? Did officers respond promptly, communicate clearly, document accurately, and follow procedures? When an incident does happen, we can review whether the team reduced harm and what needs to improve.

To communicate this to an organization, I would share regular reports that show patterns over time, actions taken, and recommendations. For example, if repeated patrols identify a lighting problem, getting that problem corrected is a meaningful result even if there was never an incident to count. Good security work includes making risks visible before something goes wrong.