Support

There's a reason I will never implement such a feature. Nothing you do has a deterministic effect on the number of attacks your site receives.

Attacks are not like page views. There's a correlation between page views and the site's popularity. Therefore an SEO consultant can plausibly say that an increase in page views correlates with an increase in the site's popularity which correlates with their work. Therefore they can use the number of page views as a key performance indicator (KPI).

Attacks have nothing to do with a site's popularity. I've seen a half-forgotten site getting hammered with attacks by a stupid bot that wouldn't take a clue. I've seen popular sites receiving a fraction of that number of attacks. Evaluating your performance in securing a site using a number that's random and unrelated to your work is at best futile, at worst an exercise in futility.

The attack graph you see in the Control Panel page is not meant to be a performance indicator. It's a visualization of the trend of attacks. The reason it's there is that most attacks come in waves. I want to be able to tell at a glance if we're in the middle of a wave of attacks. Moreover, the breakdown per block category gives me useful insight in what attackers do and whether I have a problem I haven't seen. For example, if I see Admin Query String attacks on a site I have password protected the administrator I want to troubleshoot why the password protection didn't work in these cases. If I see a massive spike in DFIShield right after I install / update a frontend extension I suspect its developer is doing something stupid and I have to investigate. In other words these trend visualizations are only useful for troubleshooting, not as a performance indicator.

The only reasonable performance indicator for security is "how many times have you been hacked" and "how serious was the hack". If you can keep both indicators to 0 you're doing a stellar job – or you're lucky. You can't know which. If you did get hacked then your performance depends on how soon you found out, how bad was it, how fast you responded, whether you collected enough information to put adequate protections in place (instead of destroying all evidence in a crazed fit of sheer panic) and whether it happened again. In short, security calls for quantitative, not quantitative, performance indicators. It's like trying to come up with performance indicators for an R&D department.