For three years, I reported a metric I was proud of.

Mean time to detect: under four hours. Trending down every quarter. Better than industry average.

Then a board member asked a question I wasn't ready for.

"What does that mean for the business?"

I gave him the context. The benchmarks. The trend line. He nodded and moved on.

After the meeting, a peer told me what he'd said on the way out.

"I still don't know if we're safe."

I had answered a different question than the one he was asking. He wasn't asking about detection speed.