A security rule that is not measured is a rule that may already be broken. Telemetry makes the defence a number that moves, so a regression is a finding instead of a suspicion.
About 1 min of reading
Build the three numbers from a log
Stamp blocks with layer and case
Before you run it, say out loud what it will print. Then open the answer.
Count blocks per layer
Before you run it, say out loud what it will print. Then open the answer.
Count blocks per day
Before you run it, say out loud what it will print. Then open the answer.
A suite that runs once a month is a suite that cannot see a regression. It runs on the same cycle as a deploy.
It records layer, case, and time. It never records the secret or the full prompt, because the log is a leak vector.
Blocks per day, wins per suite run, and layer per block. Everything else in this subject is a detail of those three.
A block rate that doubles is either a new attack or a broken layer. Both are worth a person, and the number is what says so.
If one layer blocks ninety percent of cases, the other layers are decoration. That is a fact worth knowing before it costs anything.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.