Measuring Event Success Metrics

I am helping a client update their incident response procedures, and one of my favorite references has been CISA's After-Action Report / Improvement Plan template. This template is designed for table top exercises, but can easily be adapted for actual incidents with a couple of adjustments. In particular, I like the format of Page 5, which states an objective at the top of the page and strengths observed in trying to complete that objective. It's just as important to identify what went right during an incident as much as what may have gone wrong so that we can continue to do those *right* things. The template also does a good job at identifying areas of opportunity and tying them to reference materials like policies, procedures, laws. Analysis and recommendations are provided for each area of opportunity. No need to start from scratch when there are many, many good resources out there to provide solid starting points. Don't forget to take time to look around every so often at what organizations are putting out there for cybersecurity resources. It could actually save you and your company time in the long run.

Finding the cause of an incident may be the very thing stopping an organisation from learning from it. The basic cause. The direct cause. The causal pathway. Finding one feels like progress. It gives us something to enter into the report, assign an action against and eventually close. But a cause can close a report while leaving the conditions that made the event possible completely untouched. That is why I keep returning to a different question: What conditions came together to make this event possible? “What caused it?” often pulls the investigation toward a single answer—and usually toward the person closest to the consequence. Asking about conditions forces us to look wider: The equipment. The procedure. The staffing. The planning. The production pressure. The competing priorities. The workarounds that had become normal long before the event occurred. Consider an investigation that concludes an operator failed to follow procedure. What if the procedure did not reflect the work? What if the correct equipment was unavailable? What if the workaround had been used successfully for months? The action may have been the final step in the event. That does not mean it explains why the event became possible. No investigation methodology is inherently good or bad. Every method was created to solve a particular problem. But when a method—or the way we apply it—pushes us toward one cause, it can hide the web of conditions that shaped the work. That is where the real learning sits. Not only in what someone did, but in the system that made that action available, useful or necessary. Before closing the next investigation, ask: Have we identified what went wrong—or have we changed the conditions that allowed it to make sense?

Your fundraising event raised $50,000. Success, right? Maybe. But maybe not. Standard event metrics often miss the full picture: - Dollars raised ÷ Attendees = $500/person But what about the value of relationships built? - Net revenue after expenses = $35,000 But how much staff time did it really take? - New donors acquired = 15 But did existing donors deepen their commitment? Even when resources are tight, some teams are starting to track: 📊 Relationship-based metrics - Meaningful conversations with major gift prospects - Signs of increased donor interest or trust - Referrals or introductions from attendees 📈 Long-term revenue indicators - Giving increases 6–12 months post-event - Retention rates of attendees vs. non-attendees - New names added to your major gifts pipeline 💬 Mission advancement signs - New ambassadors or advocates identified - Improved understanding of your mission (pre/post) - Compelling stories gathered for future use The most valuable outcomes of your events often don’t show up in the final revenue report. What metrics do you track to measure success beyond dollars raised?

𝗟𝗲𝗮𝗿𝗻 𝗳𝗿𝗼𝗺 𝗬𝗼𝘂𝗿 𝗣𝗮𝘀𝘁 Almost all cybersecurity regulations and standards, including ISO 27001, require documenting lessons learned after any incident within the organization. Unfortunately, even experts often misunderstand the necessity and significance of this step in incident management. The goal is not merely to document what was learned from the incident but to refine the overall incident handling process to prevent similar mistakes. The incident management team should regularly review these lessons learned, analyze them, and identify similarities to develop a corrective action plan. By examining past incidents, you can identify recurring issues and underlying causes, enabling proactive measures to address vulnerabilities and strengthen your organization's resilience. Remember, the true value lies not just in documenting lessons learned but in actively applying them to improve your incident management practices.

Most event marketers can't defend their budget. Not because events don't work. Because they're reporting the wrong things. Finance asks: What did we get from that $50K conference? And the answer is usually badge scans and booth traffic. That's not ROI. That's activity. Here's what an actual event report should include: ICP Accounts Attended How many Tier 1, 2, or 3 accounts had someone at the event? This tells you if you were even in front of the right people. Contacts Added Net-new contacts from attending accounts. Not total scans. New names in your CRM that didn't exist before. Meetings Booked Sales meetings scheduled as a direct result of the event. Not "good conversations." Actual meetings on the calendar. Qualified Pipeline (New) Net-new opportunities created post-event that meet your qualification criteria. Stage, ICP fit, value threshold. Real pipeline, not maybes. Influenced Pipeline Existing opportunities where the event helped move things forward. Deals that accelerated, re-engaged, or unstuck because of a conversation at the booth. Closed-Won Revenue Revenue from deals directly attributable or influenced by the event. The number finance actually cares about. Then calculate two ROI metrics: Pipeline ROI (Qualified Pipeline + Influenced Pipeline) ÷ Total Event Cost Use this to compare efficiency across events. ARR ROI Closed-Won ARR ÷ Total Event Cost Use this for long-term performance. One more metric worth tracking: Revenue Coverage in the Room. A directional estimate of potential new and expansion revenue based on who attended. Not a forecast. A planning tool. When you report like this, the budget conversation changes completely. You're not defending why events should exist. You're showing which ones deserve more investment. What metrics do you use to prove event ROI? P.S. let me know if there are metrics you want me to go deeper on here, too!

🕵️♂️ The Importance of Post-Incident Reviews “The best security teams don’t just respond — they reflect.” Every incident, whether it ends well or not, leaves behind data, decisions, and lessons. But most teams move on too quickly — chasing the next shift, report, or patrol — and miss the goldmine of insight that could prevent it from happening again. A post-incident review isn’t about blame. It’s about building a smarter, stronger response system. 💡 Why Post-Incident Reviews Matter They turn mistakes into training. What went right? What could be faster? Every review builds sharper instincts. They reveal hidden weaknesses. Maybe it wasn’t the response — maybe it was the communication, layout, or access policy. They improve decision speed. The next time an alarm goes off, your team knows exactly what to do — no hesitation. They build trust with clients. A transparent, documented review shows professionalism and accountability. 🧠 How to Run an Effective Post-Incident Review ✅ Gather everyone involved — guards, supervisors, control room, even maintenance if relevant. ✅ Stick to facts, not feelings. Focus on timelines, actions, and outcomes. ✅ Ask three questions: What happened? Why did it happen? How do we prevent it next time? ✅ Document and share the learnings. Use them in future drills or onboarding. 📈 The ROI of Reflection Companies that conduct structured reviews see: 60% faster resolution on repeated incidents Fewer procedural errors Higher staff confidence under pressure Because in security, experience means nothing if it isn’t analysed. 🧩 Takeaway “Every incident teaches — but only if you listen.”

A week ago, I shared that I sat down with 50+ corporate event marketers at EXHIBITORLIVE. I asked one simple question: What is the one area of your program you are actively trying to improve that would have the biggest impact? 80% of the answers came back to three things. This week, I want to break those down a bit more. Starting with the first: 1. ROI, scorecard, and measuring impact Here’s what stood out to me... Most teams are still measuring activity, not impact. Leads. Scans. Meetings. That’s where it starts, but it’s not where the conversation needs to end. Because the real pressure they’re getting internally is not: “How many leads did we get?” It’s: “What did this actually do for the business?” And that’s where things start to break. I had multiple conversations where people said some version of: “We know events work… we just can’t prove it.” That’s a problem because when budgets tighten or leadership starts asking harder questions, “we feel like it worked” is not enough to defend the spend. What the more advanced teams are starting to do looks different. They’re asking better questions: - Where are we influencing pipeline, not just creating it? - Are we accelerating deals that were already in motion? - Are we creating better quality opportunities, not just more of them? - What happens after the event, not just during it? They’re also getting more intentional about their scorecards. Not just reporting what happened… but defining upfront what success actually looks like. Because if you don’t define that early, you end up trying to reverse-engineer value after the fact, and that rarely holds up in front of leadership. The other big shift I’m seeing: Teams are starting to realize they can’t just track the event. They have to track the entire journey around it... Pre-event engagement In-event interactions Post-event movement in pipeline That’s where the real story is because events are not a one-time moment, they’re a catalyst inside a much bigger system. And until you measure them that way, you’ll always feel like you’re under-explaining your impact.

By now hopefully everyone affected by the Crowdstrike incident has fully recovered. Is that the end? Do we just move on? High performing software teams take the time to do a Learning Review after major incidents like this one. If this is not a common practice in your organization, now would be a good time to start. I'll be running a first Learning Review for an organization next week and the agenda will be very simple. • A high level overview of what happened - the specifics can be in a report • A review of what people tried for remediation, why they tried those things, what worked (and why), what didn't (and why) •What they would like to have in place for the next time. Not for this specific thing, but in general, to facilitate recovery This is an entire field of study and like anything it takes practice. The purpose of the second bullet point is to build 𝘴𝘩𝘢𝘳𝘦𝘥 𝘮𝘦𝘯𝘵𝘢𝘭 𝘮𝘰𝘥𝘦𝘭𝘴. That's where we get resilience. We're not trying to prevent or recover from this specific incident again. We're trying to get a return on the investment by spreading knowledge and understanding of how things work so people will be better prepared the next time. Suggested Resources - "The Field Guide to Understanding Human Error" by Sidney Dekker - The Howie Guide to Post-Incident Investigations What resources has your organization used to level up their post-incident return on investment?

When the Unexpected Happens: Lessons from an Operational Incident 5:30 PM: Everything was calm… until it wasn’t. I was sitting in my office, monitoring the progress of a pigging line procedure—the only critical operation underway. Suddenly, a loud, alarming sound interrupted the calm. Moments later, the operator called for urgent support. I rushed to the station and saw the main storage tank deformed, signaling a significant incident. We activated the emergency plan, secured personnel, and safeguarded the installation without hesitation. Our priority was clear: protect lives, contain the situation, and restore operations as quickly and safely as possible. This incident was a stark reminder of the importance of robust safety protocols and swift, decisive action. Drawing from that experience and others, I’d like to share the essential steps to follow when responding to an accident in oil and gas facilities: 1.     Immediate Response Prioritize the safety of all personnel and secure the accident scene. Provide medical assistance to anyone injured. Notify authorities and emergency services as necessary. 2.     Preserve the Scene Restrict access to the area to protect evidence. Document the scene thoroughly with photos, videos, and sketches. 3.     Gather Information Interview witnesses and collect relevant documents, such as operating procedures and maintenance logs. 4.     Analyze the Data Investigate the sequence of events to identify root causes. 5.     Develop Corrective Actions Create practical recommendations to prevent recurrence, addressing both immediate and systemic issues. 6.     Report Findings Share a comprehensive report with stakeholders, including findings and recommended actions. 7.     Follow-Up and Implement Solutions Monitor the effectiveness of corrective measures and update safety procedures as needed. The ultimate goal is to learn from every incident to enhance operational safety and resilience. By meticulously addressing each step, we can turn challenges into improvement opportunities. The video shown in this post is the result of the accident. We simulated how the batch of gas got into the tank and affected it using computational dynamic flow. We did a complete paper on that analysis, which also includes mechanical stresses and deformation. Have you faced a similar situation in your operations? Let’s discuss how we can work together to create safer and more efficient facilities.