Security Operations Metrics

What it is

Metrics are measurements that show how well the security team detects, responds and fixes problems. Without them, a team cannot tell whether a change helped or whether the organisation is getting safer.

A key performance indicator (KPI) measures how well a process performs against a goal, such as time to respond. A key risk indicator (KRI) signals growing exposure, such as the number of critical vulnerabilities past their deadline.

How it works

Time based metrics

Each metric is a difference between two timestamps in the incident record.

The letters MTTR are used for several meanings, including respond, recover, repair and remediate. A question or report should say which one, and the measurement start and end points must be defined the same way every time.

Mean means the average: add up the times and divide by the number of incidents.

Incident   Occurred   Detected   Contained   Detect time   Contain time (from detection)
A          08:00      08:30      09:30       30 min        60 min
B          10:00      12:00      12:30       120 min       30 min
C          13:00      13:15      14:15       15 min        60 min

MTTD     = (30 + 120 + 15) / 3 = 55 minutes
Mean time to contain = (60 + 30 + 60) / 3 = 50 minutes
Median detect time = 30 minutes

The mean of 55 minutes is pulled up by incident B. The median of 30 minutes tells a different story, which is why many teams also report the median or a high percentile.

Detection quality metrics

• True positive rate: the share of real attacks that the tools detect.
• False positive rate: the share of alerts that turned out to be harmless. A high rate wastes analyst time and causes alert fatigue.
• Alert volume and backlog: how many alerts arrive and how many wait for review.
• Detection coverage: how many relevant attack techniques have tested detections, often mapped to MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge).
• Source of detection: found by tools, found by a user report or found by an outside party. Detection by an outside party is a warning sign.

Incident metrics

• Number of incidents by type and severity.
• Repeat incidents of the same type.
• Percent of incidents handled within the service target.
• Cost and downtime per incident, where measured.
• Escalation rate.

Phishing campaign metrics

The phishing click rate is the number of users who clicked divided by the number of users targeted, shown as a percentage. If 18 of 240 users clicked, the rate is 18 divided by 240, which is 7.5%.

Track it with related measures:

• Report rate: users who reported the message divided by users targeted. A rising report rate is a good sign even if some users still click.
• Credential submission rate: users who entered a password on the fake page.
• Time to first report: how fast the first user alerted security.

Compare results by department and over successive campaigns. Keep the difficulty of the tests comparable, and use the numbers to target training, not to punish people.

Remediation effectiveness

Remediation effectiveness shows whether vulnerabilities and incident actions are really being fixed, and whether the fixes hold.

A high recurrence rate means that remediation is not effective, even if many tickets are closed.

Using metrics well

1. Define each metric. Write the formula, data source and start and end events.
2. Choose a few that match goals. A small, meaningful set beats a long list.
3. Track trends over time, not only single values.
4. Tailor the view to the audience, as covered in the reporting pages.
5. Pair with context. A rise in detected incidents may reflect better monitoring, not worse security.
6. Review and improve. Use results to adjust staffing, tools, playbooks and training.

Weak practices include chasing a number so that it looks good (for example, closing alerts quickly without investigation), comparing teams with different definitions, and reporting averages that hide extreme cases.