Transmission 12 · Measurement

SOC Metrics That Measure Coherence

Most security dashboards measure motion: alerts processed, tickets closed, events ingested per second. Motion metrics reward noise — the more the instrument rattles, the busier and healthier the program looks. Coherence metrics measure the opposite: how cleanly the signal comes through, and how quickly the system returns to tune.

The four that matter

• Detection precision: true positives over total fires, per detection and portfolio-wide. The single best proxy for signal integrity.
• Alert-to-incident ratio: how many rattles it takes to find one real note. Rising ratio means the noise floor is winning.
• Time to return to baseline: not just detection speed — the full arc from distortion to restored known-good, per service.
• Analyst load and escape rate: alerts per analyst-hour, and findings that surfaced outside your detections (user reports, third parties). Escapes are the coverage map’s honest editor.

What to stop reporting

Blocked-attack counts inflated by automated scanning. Raw event volume. Tool coverage percentages against checklists no attacker has read. Any number that goes up when you add noise is measuring the rattle, not the music.

Metrics as tuning feedback

A coherence metric exists to drive a tuning action: falling precision retires or repairs a detection; a rising alert-to-incident ratio triggers a calibration pass; slow return-to-baseline funds recovery rehearsal. If a metric cannot name the action it demands, it is decoration — and decoration is noise.

Measure the music, not the rattle. We synchronize.