Many security professionals still rely on noisy SOC metrics as the main benchmarks for performance, which I refer to as “activity theater.” This approach focuses on quantity over quality, resulting in high alert volumes that are mostly noise, making it difficult to detect true threats and vulnerabilities.
This article introduces a new perspective on how CISOs should evaluate metrics to provide accurate information to boards and CEOs about the security status of their organization. It emphasizes the importance of focusing on risk reduction as the ultimate metric.
Challenges of Excessive Metrics
Security teams, both in-house and at managed SOCs, are overwhelmed with metrics. A busy SOC often indicates poor tuning and neglected protocols, leading defenders to be distracted from addressing actual threats. A well-tuned SOC should operate quietly, with rare and precise alerts that enable defenders to identify anomalies and respond effectively.
True positives, especially outside of phishing incidents, are unique and infrequent. Properly tuned systems can ensure that 90% of true positives require immediate action, highlighting the importance of quality over quantity in metrics.
Risk reduction metrics should take precedence in CISOs’ board reports. This shift in mindset towards “less is more” can lead to stronger and more resilient security measures.
The Impact of Noise on Security Risk
An excess of reactive “busy work” in a SOC can increase security risks and prevent teams from focusing on essential tasks such as managing transformations and securing critical business processes. By prioritizing focused metrics, organizations can analyze critical alerts accurately, leading to better detection and refined response capabilities.
Smaller teams often struggle with outdated systems that add unnecessary noise without providing adequate protection. Clearing legacy security systems can simplify the environment, improve visibility, and identify weak points within the organization.
Outdated security measures applied to modern cloud environments can create blind spots and increase the likelihood of compromises. Busy SOCs also make it challenging to stay up to date with patching, making it harder to implement preventative measures.
Additionally, the human cost of activity theaters includes alert fatigue and burnout among security professionals, affecting work quality, career longevity, and mental health.
The Ideal State of a Quiet SOC
The goal for security defenders is to reduce alert volume while enhancing detection capabilities. By continuously monitoring and adapting, defenders can respond strategically and swiftly to suspicious activities. Viewing every detection as a security failure emphasizes the importance of maintaining a quiet SOC environment.
Focusing on metrics such as containment speed, risk reduction, detection quality, and automation effectiveness can provide valuable insights for CISOs and stakeholders. Utilizing AI and automation technologies can help analysts and threat hunters prioritize urgent notifications and respond effectively.
Experts in the Cyber Defense Center prioritize incidents that require human intervention, while deterministic automation handles the majority of alerts. This approach, outlined in the whitepaper “Cutting Through the Hype: What Agentic AI Really Means and the Future of Security Operations,” highlights the value of a quiet SOC in improving security outcomes.
Strategic Metrics Reporting
Organizing SOC metrics based on audience and measurement level, known as “Metrics Altitude,” can improve reporting effectiveness. Strategic metrics like root-cause recurrence rates are suitable for board reports, while operational and tactical metrics cater to management and day-to-day operational needs.
While every alert is important, presenting high-fidelity alerts to boards and CEOs can lead to more actionable insights and tangible security actions. By focusing on quality over quantity, security teams can deliver value more efficiently.
Craig Jones, the Chief Security Officer at Ontinue, oversees the company’s global network of Security Operations Centers (SOCs) and has extensive experience in security operations. He emphasizes the importance of quality metrics and risk reduction in improving security outcomes. Craig is a respected cybersecurity expert with certifications such as GCIH and CISSP, actively contributing to the cybersecurity community.
To connect with Craig and learn more about Ontinue’s security services, visit his LinkedIn profile or the company website at https://www.ontinue.com/
