Cybersecurity metrics that matter (and how to measure them)

This article provides guidance on SOC success metrics, emphasizing accuracy, volume, and timeliness while cautioning that mean-time-to-* metrics can be misleading without standardized definitions and context. It recommends using medians over means, clearly defining when the measurement clock starts and stops for detect/respond/mitigate, and distinguishing dwell time from breakout time, advocating for consistent, transparent methodologies to make time-based metrics meaningful.