The SOC Metrics Guide

Alerts processed per day is not a security metric — it is a workload metric. A SOC that processes 10,000 alerts per day and closes them all as false positives is not more secure than one that processes 100 high-fidelity alerts and reaches a verdict on every one. Volume metrics reward busyness; outcome metrics reward effectiveness.

The shift from activity metrics to outcome metrics is the same shift as the broader AI SOC model: the question is not 'how much did we do?' but 'how much risk did we reduce, how fast, and at what cost?'

Mean Time to Verdict (MTTV): time from finding creation to documented verdict. Target: under 4 minutes for autonomous verdicts, under 30 minutes for human-escalated. This is the single most important operational metric — everything else is a component of it.

Autonomous verdict rate: percentage of findings that reach a verdict without human input. Target: 90%+ for a mature AI SOC. Below 70% indicates the question sets need tuning or the detection quality is low. TP:FP ratio by detection: for each detection, the ratio of true positives to false positives in the trailing 30 days. High-severity detections should target 20:1 or better.

Coverage delta: net new MITRE ATT&CK techniques covered per quarter. A programme that is not expanding coverage is maintaining a static risk posture against a dynamic threat landscape. Cost per verdict: total platform + analyst cost divided by verdicts rendered. This is the CFO metric — it translates security operations into business language.

Every metric in the five-metric framework is derivable from the ManySignal case timeline without any manual tracking. MTTV is the delta between case_created_at and verdict_timestamp. Autonomous rate is the percentage of cases where verdict_actor is 'agent' rather than a human identity. TP:FP comes from verdict values on closed cases.

The report agent generates a weekly metrics digest automatically. Configure the digest to send to a Slack channel and a PDF archive. The digest is the weekly ops review agenda — no additional reporting work required.

Executives need three numbers: how many threats did we stop, how fast, and are we improving? Present MTTV trend, autonomous verdict rate trend, and coverage delta. Use 30-day rolling averages and show quarter-over-quarter direction. Do not present raw alert counts to executives — it creates perverse incentives.

For board-level risk reporting, map the coverage delta to the threat actors most relevant to your sector. 'We added coverage for three techniques used by APT29 this quarter' is more meaningful than 'we wrote twelve new detections'.

Metrics are only useful if they trigger action. Build a weekly tuning loop: review the five metrics, identify any that regressed, trace the regression to its source (specific detection, question set, or connector), and create an engineering ticket to fix it.

MTTV regression almost always traces to either a new finding type without a question set (forcing human triage) or a resolver that is timing out. TP:FP regression traces to a detection that has drifted from its original context — tuning needed. Autonomous rate regression traces to threshold settings that were never calibrated.