The Fault in Our Metrics: Rethinking How We Measure Detection & Response
summary
Argues that common metrics mislead and offers concrete replacements: track time spent on false positives (not alert counts) and roll automated time into saved human hours; break mean-time metrics into phase-by-phase components and filter out built-in time to make controllable gaps zero; prioritize detection work by a top five threats list and use sampling-based MITRE-style purple tests instead of full coverage; map progress to a Threat Detection & Response maturity model with 14 capabilities and metric categories Streamline, Vigilance, Exploration, Readiness.
AI-written summary · about
chapters (12)
- 0:00The problem with metrics
- 6:00Speaker background
- 6:44Mistake 1: Losing the goal
- 7:52The SABER framework
- 15:25Mistake 2: Missing controls
- 15:37Metrics and control
- 19:14Mistake 3: Proxy metrics
- 19:48Prioritizing threats
- 22:48Mistake 4: Altitude issues
- 23:43The metric pyramid
- 24:35Mistake 5: Asking why
- 24:54Maturity models and closing
related talks
53mMetrics that Matter.Confidence & Resilience in Your Security Program
40mYour Metrics Suck! 5 SecOps Metrics That Are Better Than MTTR
38mHow I Learned to Stop Worrying and Build a Modern Detection & Response Program
01h 01mFinding Metrics that matter and using them safely
40mCybersecurity Metrics Development for Board and Risk Committee Reporting
36mThe road to world-class observability
37mIncident Management Metrics That Matter
33mThe Problem with MTTR: Learning from Incident Reports