SOC Metrics: the 12 KPIs every Security Operations Center should report

Grey Mouse Studio · Updated 28 September 2026 · 9-minute read

A good security operations center (SOC) dashboard answers three questions in under a minute: are we catching real attacks fast, are we closing them within SLA, and is the team sustainable? These 12 SOC KPIs do that — with a definition, the formula and a sensible target for each.

The 12 SOC KPIs at a glance

Targets are illustrative. Set yours from your own baseline, risk appetite and staffing.

Speed metrics: MTTD, MTTA and MTTR

Speed is what attackers exploit, so leadership cares most about three numbers: mean time to detect (how long an attacker was active before you noticed), mean time to acknowledge (how long an alert waited for a human) and mean time to respond (how long until containment began). Report them for P1/P2 only — averaging in low-severity noise hides the cases that matter.

Every KPI explained

1. Mean time to detect (MTTD)

Average hours from the first malicious activity to the first alert, for confirmed true positives. How to calculate: Sum of (first alert − first malicious activity) ÷ confirmed incidents. Good looks like: Falling month on month; many teams aim for under 24 hours. Who needs it: Leadership, board.

2. Mean time to acknowledge (MTTA)

Average minutes from alert creation until an analyst takes ownership, for P1/P2 alerts. How to calculate: Sum of (owner assigned − alert created) ÷ P1/P2 alerts. Good looks like: Minutes, not hours — e.g. 15 minutes for P1/P2. Who needs it: SOC manager.

3. Mean time to respond (MTTR)

Average hours from alert creation until containment starts or the case is handed to incident response, for P1/P2. How to calculate: Sum of (containment started or IR handoff − alert created) ÷ P1/P2 cases. Good looks like: A few hours for P1/P2 — e.g. 3 hours. Who needs it: Leadership, board.

4. Mean time to close

Average hours to close resolved cases, all severities. How to calculate: Sum of (closed − created) ÷ resolved cases. Good looks like: Track by severity; watch the trend. Who needs it: SOC manager.

5. P1/P2 within response SLA

Share of P1/P2 cases contained or handed to IR within the SLA. How to calculate: P1/P2 cases within SLA ÷ all P1/P2 cases. Good looks like: 95% or better. Who needs it: Leadership, SteerCo.

6. Overdue open cases

Open cases already past their SLA due date, by severity and owner team. How to calculate: Count of open cases where today > due date. Good looks like: Zero P1/P2 overdue. Who needs it: Daily stand-up.

7. False-positive rate

Alerts closed as false positive as a share of all alerts closed in the period. How to calculate: False-positive closures ÷ all closures. Good looks like: Falling; under 30% is a common goal. Who needs it: Detection engineering.

8. Alerts per analyst per shift

Average alerts a Tier 1 analyst triages per shift — your fatigue and staffing signal. How to calculate: Alerts triaged ÷ (analysts × shifts). Good looks like: Sustainable load — e.g. under 45 per 12-hour shift. Who needs it: SOC manager, budget.

9. MITRE ATT&CK priority coverage

Priority ATT&CK techniques with at least one production detection. How to calculate: Covered priority techniques ÷ priority techniques. Good looks like: Rising quarter on quarter — e.g. 70%. Who needs it: Detection engineering, QBR.

10. Critical log sources healthy

Critical log sources onboarded and reporting as expected. How to calculate: Healthy critical sources ÷ required critical sources. Good looks like: 95% or better. Who needs it: SOC engineering.

11. Escalation rate to incident response

Share of cases escalated to the IR team — shows real attack volume and triage quality. How to calculate: Cases escalated to IR ÷ cases closed. Good looks like: Stable; sudden jumps need a look. Who needs it: IR lead, leadership.

12. EDR / agent coverage

Endpoints and servers with a healthy EDR agent, out of all managed assets. How to calculate: Assets with a healthy agent ÷ managed assets. Good looks like: 98% or better. Who needs it: Endpoint team, SteerCo.

Which SOC metrics go in which meeting

How SOC metrics map to NIST CSF 2.0

Most SOC KPIs evidence the Detect and Respond functions of the NIST Cybersecurity Framework 2.0: continuous monitoring (DE.CM) and adverse event analysis (DE.AE) cover detection speed, coverage and log health; incident management (RS.MA) and incident analysis (RS.AN) cover acknowledgement, response time and escalation. Reporting them to leadership also supports Govern oversight (GV.OV).

Five mistakes that make SOC dashboards useless

1. Counting alerts as success. "We handled 12,000 alerts" says nothing about risk. Report outcomes: time to detect and respond.
2. Averaging all severities together. Split P1/P2 from the rest, or noise drowns the signal.
3. No targets. A number without a target and a trend can't drive a decision.
4. Hand-built slides every week. Keep one tracker as the source of truth and copy numbers into the deck.
5. Ignoring the analysts. Alerts per analyst and false-positive rate predict burnout and missed attacks.

Frequently asked questions

Educational content and templates only — not legal, audit or compliance advice. MITRE ATT&CK is a registered trademark of The MITRE Corporation. NIST CSF references are for alignment only; no endorsement is implied.