What is the primary purpose of SOC KPIs like mean time to detect and mean time to respond?

• A. Evaluate incident detection and response times.
• B. Measure operator performance.
• C. Identify hardware failures.
• D. Track policy violations.

Answer: (B)

These KPIs focus on how quickly the security operations center detects and responds to incidents. Mean time to detect measures the time from when an incident begins to when it’s identified, and mean time to respond measures the time from detection to containment or resolution. The main purpose is to evaluate and improve the speed of detection and response—the efficiency of the SOC’s monitoring and incident-handling processes. They help establish baselines, drive improvements in tooling and processes, and reduce dwell time. This isn’t about hardware reliability, policy violations, or evaluating an individual operator’s performance in isolation.