The best features MetricStream offers are the nice dashboards. However, I believe that the same system could be built much cheaper. With the help of one Python developer and one data engineer, it could be created more easily. To me, it appears to be mostly a marketing-driven product, functioning basically as a better package for something similar to Microsoft Forms. Regarding features, I think it was nice when I knew what was needed, and when a client had seen the issue beforehand. MetricStream is something like an all-in-one solution where I do not need to write scripts or conduct audits. However, it may be a cheaper option when an audit is not necessary, such as a Microsoft audit or governance audit. It might be cheaper for two or three months, but when deeper research on a company is needed, it is not suitable. Essentially, it is an audit platform with a nice dashboard. MetricStream has positively impacted my organization because we sell it in Europe. However, I implemented it at a couple of companies and I do not see any positive impact. For the client, they can see a nice platform with a friendly UI and a dashboard. For a developer, there is basically no added value because all these things can be obtained from scripts. Scripts can be written easily and are a really cheap alternative. I do not see any reason to buy MetricStream for a couple of thousand euros per month when scripts can be written with internal audit, cyber risk audit, or policy searching capabilities. Essentially, it is a business version of Grafana. A specific example of how a client benefited from using MetricStream is that it is better for usability. If a client needs to check risk inside a cloud environment or internal environment, they have a nice dashboard with compliance status, open issues, and key risk information. If the management part is implemented, there is also a nice dashboard with compliance status ranging from zero to 100, control test requests and results, and a nice dashboard from the forms.
