Abstract
This paper describes the concept and use of Indicators for cybersecurity decision support. We define an Indicator as observable information about a Device Under Test (DUT) or System Under Test (SUT) that potentially can underpin insight on its cybersecurity posture. We describe different types of Indicators, how they are generated by tools and components in a cybersecurity testing and monitoring framework, how they may be transformed to increase their utility and illustrate their use via an exemplary case in smart manufacturing. We summarise key observations and properties of Indicators based on collaborative multidisciplinary work that has brought together developers of tools that generate Indicators, tools that consume and analyse indicators, and representatives of users who have motivating scenarios where Indicators may inform about their cybersecurity posture.