Measuring SOC performance¶

Without measurable indicators, a SOC cannot improve. Lean metrics help track effectiveness, prioritise improvements, and justify investments without overwhelming the team with unnecessary data.

Key metrics¶

• Mean Time to Detection (MTTD): Average time from initial event to detection.

• Mean Time to Resolution (MTTR): Average time to contain or remediate an incident.

• Analyst productivity: Alerts processed per analyst, response times, and workflow adherence.

• Case volumes and escalation breakdowns: Monitor recurring incident types, frequency, and whether alerts required escalation.

Tips¶

• Keep the metric set small and focused on actionable insights.

• Use dashboards to make performance visible and immediate.

• Link metrics to improvement initiatives, not just reporting.

Example use¶

Tracking MTTR over three months may reveal that certain alert types consistently take longer to resolve, highlighting gaps in workflow or analyst training.