In open beta — $100/month flat for your whole team See pricing →
OKR template

Security prevention and detection OKR examples

This is a free security prevention and detection OKR template with 2 objectives, 6 key results, and 8 starter initiatives you can copy. The easy attack paths closed — phishing, stale access, silent intrusions — and detection fast enough to matter. It is written for Series A and Growth companies.

  • 2 objectives
  • 6 key results
  • Series A
  • Growth

What does a security prevention and detection OKR look like?

Copy these as they are and edit the numbers to your own baselines. The objective is the outcome you want to be true by the end of the quarter; the key results are how you will know it happened; the initiatives are the bets you are making to get there.

Objective 1 Operational

Make the easiest attack path a dead end

Most incidents start with a password, a phish, or an account nobody turned off. The annual goal is an attack surface where the cheap paths are gone; this quarter closes the three doors attackers actually use.

KR 1.1 Headline

Employee accounts protected by phishing-resistant MFA 40% → 100% of the employee accounts

How it is measured: Employee accounts on hardware-key or passkey MFA, over all employee accounts

Baseline: 40% · Target: 100%

Initiatives

  • Hand out hardware keys with a 30-day cutover date and a help desk hour
  • Turn off SMS and app-code fallback once a team is fully enrolled
KR 1.2

Employees who clicked the quarterly phishing test 18% → 4% of the employees tested

How it is measured: Test-phish clicks over employees tested

Baseline: 18% · Target: 4%

Initiatives

  • Send a two-minute debrief to every clicker the same day, no shaming
KR 1.3

Median hours from an employee leaving to all access removed 72 → 2

How it is measured: Median hours between departure and last credential revoked

Baseline: 72 hours · Target: 2 hours

Initiatives

  • Drive offboarding from the HR system so access ends when employment does
Objective 2 Operational

Know about the incident before anyone else does

Prevention fails eventually; detection speed decides whether that is an incident or a headline. The annual goal is finding out first, every time — this quarter proves it against simulated intrusions and an alert stream a human can actually watch.

KR 2.1 Headline

Median minutes to detect a simulated intrusion 190 → 20

How it is measured: Median minutes from simulated attack start to a human acknowledging the alert

Baseline: 190 minutes · Target: 20 minutes

Initiatives

  • Run a monthly purple-team exercise against the three likeliest attack paths
  • Alert on the five behaviours those exercises show we currently miss
KR 2.2

Alerts a human actually needed to see 8% → 60% of the alerts fired

How it is measured: Alerts leading to a real action, over alerts fired

Baseline: 8% · Target: 60%

Initiatives

  • Delete or downgrade every alert that fired ten times with no action taken
KR 2.3

Incident drills run with a written debrief 0 → 3 per quarter

How it is measured: Tabletop or live incident drills completed with a debrief document

Baseline: 0 · Target: 3

Initiatives

  • Rotate who runs point each drill so response never depends on one person

Why are these key results written this way?

Every example above passes the same quality rubric Hespia grades real OKRs against. Four rules do most of the work, and they are worth keeping when you edit the numbers:

  1. The objective has no number in it

    An objective is a qualitative state of the world you want to be true. The number belongs one level down, on the key result. An objective with a metric in the title is really a key result that lost its parent.

  2. Every key result shows a baseline, not just a target

    "Employee accounts protected by phishing-resistant MFA 40% → 100% of the employee accounts" is readable at a glance because the movement is visible. A target with no starting number cannot be paced weekly, so nobody can tell in week 4 whether it is slipping.

  3. Every ratio names a denominator the team cannot shrink

    "Of the accounts that started the quarter" is a fixed denominator. "Of active accounts" is not — the definition of active can move, and the percentage improves without anything real changing.

  4. Enabling work sits in initiatives, not in key results

    "Launch the new onboarding" is work; "activation in week one from 31% to 45%" is the result the work is meant to produce. Shipping the project is not the same as the outcome arriving, so the two live at different levels.

A template remembers. It doesn't chase.

Copied into a doc, these 6 key results depend on someone reopening the doc every week. Hespia seeds this exact board in one click, then reads pace on every key result weekly, flags what is slipping in week 4 instead of week 13, and writes the digest nobody wants to write. $100/month flat, whole team included.

Get started

Security prevention and detection OKR questions

What are good security prevention and detection OKRs?

Good security prevention and detection OKRs pair a qualitative objective with key results that each carry a number. In this template the objectives are "Make the easiest attack path a dead end" and "Know about the incident before anyone else does", and every key result underneath states the metric, where it starts, and where it needs to land — for example "Employee accounts protected by phishing-resistant MFA 40% → 100% of the employee accounts". If a key result has no starting number, it is a task rather than a key result.

How many key results should a security prevention and detection team have?

Three to five key results per objective, and no more than two or three objectives per team in a quarter. This template uses 2 objectives and 6 key results in total, which is a realistic quarter for one team. More than that and the weekly check-in stops fitting in fifteen minutes, which is how the ritual dies.

Are these security prevention and detection OKR examples free to use?

Yes. Every objective, key result, and initiative on this page is free to copy into any doc, spreadsheet, or goal tool, with no signup and no email. Hespia, the AI mentor that tracks weekly pace on each of these key results and chases the owners, is $100/month flat for the whole team.

Why does every key result here name its denominator?

Because a ratio without a stated denominator can be improved by shrinking the bottom number instead of growing the top one. A team that reports "percentage of active accounts" can quietly redefine "active" and post a win it did not earn. Every percentage in this template names a denominator the team cannot move, such as the accounts that started the quarter.

More OKR templates

Security OKR examples

Exposure that actually shrinks, and trust reviews that stop holding up deals — no “get certified” goal in sight.

Company and founder OKR examples

The two goals a founder-led company runs on: win the segment you chose, and make the business predictable enough to plan a year around.

Engineering OKR examples

Delivery and reliability as outcomes, not story points: how fast a change reaches customers, and how rarely it hurts them.

Engineering quality and tech debt OKR examples

Bugs found before customers find them, and the accumulated debt that taxes every change — paid down where it slows you most.

← All OKR templates