How do you measure SOC performance? What are common KPIs?

• A. Metrics such as mean time to detect (MTTD), mean time to respond (MTTR), alert volume, true positive rate, and detection coverage.
• B. Only the number of alerts per day.
• C. User satisfaction scores.
• D. Network bandwidth utilization.

Answer: (A)

SOC performance is measured by how quickly threats are detected and resolved, how accurately alerts reflect real issues, how much workload the team can handle, and how comprehensively the monitoring covers the environment. Mean time to detect shows how fast the SOC notices a threat from its onset, so shorter times mean better visibility and faster actions. Mean time to respond tracks the speed of containment and remediation after a detection, with shorter times reducing impact. Alert volume helps you understand workload and triage needs, indicating whether the SOC can keep up with the stream of signals. True positive rate reflects accuracy, showing how many alerts are legitimate threats versus false alarms—higher accuracy reduces alert fatigue and improves trust in the alerts. Detection coverage ensures you’re monitoring the right assets, data sources, and environments, uncovering blind spots before attackers exploit them.

Other options fall short because a single metric like alerts per day doesn’t capture speed, accuracy, or coverage; user satisfaction scores measure service quality rather than security effectiveness; and network bandwidth utilization focuses on capacity and performance, not how well the SOC detects and responds to threats.