Leading Indicators in Information Security

The document discusses leading indicators, which are inexpensive to collect metrics that can accurately indicate the presence of a condition, though not necessarily its nature. It draws an analogy between leading health indicators like temperature that predict illness and proposes investigating easily measured IT system attributes that could predict an insecure configuration, giving the example of examining whether a large number of open ports correlates to higher vulnerability. The document suggests evaluating environments using such leading indicators to determine security risks and needed additions.