Fast averages can hide wrong answers, and a SOC running AI first-pass work produces a lot of fast averages.

The big picture: Mean time to detect and mean time to respond became the default SOC scorecard because, for most of the SOC's history, analyst time was the scarce resource. A human read every alert, so the speed at which they reached it was a fair proxy for how well the operation ran. When an AI layer picks up the alert, gathers the evidence, and closes most cases in minutes, that proxy breaks in a specific way. The machine sets the pace on the high-volume routine cases, those cases dominate the average, and the headline number improves whether or not the verdicts behind it were correct.

Why it matters: A mean-time metric has no field for correctness. An alert auto-closed as benign in 40 seconds lowers MTTR by exactly as much as one closed correctly. A real intrusion misclassified as noise never enters MTTD at all, because it was never counted as a detection. The UK's National Cyber Security Centre made the underlying point in April: a scorecard built on ticket throughput rewards closing alerts over investigating them. Put an AI SOC layer on that same scorecard and the same incentive gets written into the system's objective function.

By the numbers:

AI use in cybersecurity jumped from 50% to 78% of practitioners in a single year, and the share reporting significant AI shortcomings in threat detection and response rose from 45% to 63%, per the SANS Institute's 2026 AI Survey. Only 27% describe their AI deployment as mature production, and more than half report no formal audit framework.
Gartner expects 70% of large SOCs to pilot AI agents by 2028, with only 15% seeing measurable improvement without a structured evaluation process, according to its report Validate the Promises of AI SOC Agents With These Key Questions, as summarized by SC Media.
In the fastest cases Unit 42 observed, attackers went from initial access to confirmed data exfiltration in 72 minutes, a 4x year-over-year acceleration, per its 2026 incident response findings. In 87% of incidents, investigators needed evidence from two or more distinct sources to establish what happened.
Average breakout time from initial access to lateral movement sits at 29 minutes, per CrowdStrike's 2026 Global Threat Report.

Put those together and the measurement problem gets concrete. Adoption is outrunning validation, attacker timelines are shrinking toward the length of a single shift handoff, and the metric most SOCs report to leadership can't distinguish a fast right answer from a fast wrong one.

The verified-outcome scorecard: six measures for a SOC where machines go first

Nobody should throw out MTTD and MTTR. Boards understand them, auditors ask for them, and they still carry signal once they're segmented properly. What they need is company: a small set of measures that answer the questions speed can't. Was the machine right? What did it miss? Did the hard cases get the human attention they required? We call this set the verified-outcome scorecard.

1. Segmented MTTD and MTTR

Report time metrics separately for three populations: cases the machine closed, cases the machine escalated, and cases that originated with a human (a hunt, a user report, an external notification). The blended mean is dominated by auto-closures and will look excellent almost by construction. The escalated segment is where your team's real response speed lives, and it's the number that should trend down as analysts get better evidence handed to them. Report medians and 90th percentiles alongside means, since a handful of long-running complex investigations will distort a mean in either direction.

2. Verdict accuracy on sampled closures

Each week, pull a random sample of machine-closed cases and have a senior analyst re-investigate them without seeing the original verdict. The agreement rate is your verdict accuracy. Stratify the sample by detection category so rare, high-severity categories aren't drowned out by phishing volume, and track the reopen rate as a secondary signal. Blind review matters because of automation bias, which Georgetown's Center for Security and Emerging Technology defines as "the tendency for an individual to over-rely on an automated system." A reviewer who sees the AI's conclusion first tends to check whether it sounds plausible, and plausibility is a weak test of a verdict.

3. Escape rate

Escape rate counts incidents discovered later, through threat hunting, purple team exercises, incident response, or an outside party, whose early signals the system saw and closed or deprioritized. This is the false-positive problem's quieter twin: the false negative, and it's the one MTTD is structurally unable to see. Escapes will be rare, which is exactly why each one deserves a full post-incident review of what the machine had, what it concluded, and why.

4. Escalation precision

Of the cases the AI hands to a human, what share needed human judgment, either because they were confirmed incidents or because the evidence was ambiguous enough to require a decision? Low escalation precision means the machine is exporting its uncertainty back to the queue and recreating alert fatigue one level up, at Tier 2, where analyst time is most expensive. Pair it with verdict accuracy: precision tells you whether escalations are worth a human's time, and sampled closures tell you whether anything that should have been escalated wasn't.

5. Evidence completeness

For what share of machine verdicts can a reviewer reconstruct which data sources were queried, what came back, and why the conclusion followed, without rerunning the investigation? A correct verdict that can't be explained still fails three practical tests: it can't be audited, it can't be defended to a regulator or insurer, and it can't teach a junior analyst anything. This measure also sets the cost of measures 2 and 3. When the reasoning chain is on the record, a sampled re-review takes minutes. When it isn't, every review starts from scratch.

6. Attack-window coverage

Measure time to a confident verdict plus time to containment for a given attack path, then compare it against how fast attackers actually execute that path. The first post in this series introduced attack-window coverage as an outcome metric. It belongs here because it reframes speed around the adversary's clock. If an identity-based intrusion can reach exfiltration in 72 minutes, a 20-minute median to verdict on escalated identity alerts is a very different number than the same median on phishing triage.

What industry experts are saying

NCSC CTO for Architecture Dave Chismon argued in an April blog post that the wrong metrics can do active damage: "an analyst being measured on 'number of tickets processed' is incentivised to quickly find a reason to close it as a false positive." His alternative is blunt: "There is only one metric that shows a SOC's efficacy: does it detect (and respond to) attacks in a timely manner?" Chismon also concedes the catch, that real attacks should be rare enough to make this hard to measure directly, which is why he points SOCs toward red and purple teaming to generate the evidence, as Help Net Security reported.

Command Zero CPO Alfred Huger has made the same argument about where a SOC's attention should go. "What mattered were those ones that escaped," he told Insight Partners. "Those are the ones that are going to put you on the front page of The New York Times, not the ones you knocked down." Alert-processing speed counts the ones knocked down. Escape rate and sampled accuracy are how a SOC starts counting the other kind.

Gartner analysts Craig Lawson and Andrew Davies frame the evaluation of AI SOC agents in similar terms: verify that task reduction is real, measure outcomes beyond alert processing, and require transparency into how the agent reaches its decisions, per SC Media's summary of the report. The 15% figure is the warning attached: most pilots that skip structured evaluation won't be able to show they worked.

The limits of the new scorecard

Between the lines: MTTR falls out of a ticketing system for free. Every measure above costs something to collect. Sampled accuracy consumes senior analyst hours. Escape rate depends on purple team cadence and on post-incident reviews honest enough to trace a miss back to an auto-closure. The statistics are also less forgiving than a dashboard suggests: a weekly sample of 100 closures showing 95% agreement carries a 95% confidence interval of roughly plus or minus four points, so week-over-week swings of a few points are mostly noise. Trend the numbers monthly or quarterly, and grow the sample in categories where a miss is expensive. And the whole scorecard assumes the platform shows its work. If a machine verdict arrives without a traceable chain of evidence, measures 2, 3, and 5 can't be collected at any reasonable cost.

The bottom line: MTTD and MTTR still belong on the dashboard, segmented by who did the work. Once machines do first-pass triage and investigation, the questions a CISO has to answer for a board or a CFO move from how fast to how often right, what got missed, and where the recovered analyst hours went. Verdict accuracy, escape rate, and escalation precision are what let a SOC show that its speed is backed by correct decisions.

Terms in this post

Terms defined in Command Zero's glossary are linked below. Terms without a glossary entry yet are defined here.

What is a false negative in a SOC?

A false negative is a malicious event that a detection or triage process classifies as benign or fails to flag, allowing the activity to continue undetected.

What is escape rate?

Escape rate is the share of confirmed incidents that were discovered later by other means, such as threat hunting, purple teaming, or external notification, after their early alerts were closed or deprioritized by the SOC's triage process.

What is verdict accuracy?

Verdict accuracy is the rate at which an independent reviewer, re-investigating a random sample of closed cases without seeing the original determination, reaches the same verdict as the original analyst or AI system.

What is escalation precision?

Escalation precision is the percentage of cases escalated from an automated or first-pass triage layer to human analysts that actually required human judgment, either as confirmed incidents or as cases with ambiguous evidence.

What is time to confident verdict?

Time to confident verdict is the elapsed time from alert creation to a determination supported by enough evidence that a reviewer could act on it or defend it, as opposed to the time at which a ticket was simply closed.

What is automation bias?

Automation bias is the tendency for people to over-rely on the output of an automated system, including accepting its conclusions when contradictory information is available.

Direction of the Modern SOC: Why MTTD and MTTR Are No Longer the Whole Story