No Metrics Are Better Than Bad Metrics in the SOC, Says NCSC

The NCSC warns that common SOC metrics (ticket counts, time-to-close, volume of rules/logs) can incentivize poor behaviour; instead the only meaningful outward metric is time-to-detect/time-to-respond (TTD/TTR). The guidance recommends red/purple teaming to assess TTD/TTR and suggests internal metrics such as hypothesis-led hunting, maximizing true positives, analyst training and job satisfaction, and log coverage to improve SOC performance.