Post by 
November 1, 2025 | 
Security operations must be measurable, repeatable, and business-focused; the right metrics turn SOC work into quantifiable value that CISOs and CFOs can understand and act on. This post explains the core metrics every SOC as a Service should report and presents an anonymized case study using real attack data from a week’s worth of our data. In particular, the data and focus of this post are on Layer 7 DDoS mitigation as part of the SOC service.
Key metrics to measure SOC performance
MTTD (mean time to detect)
Time between the beginning of malicious activity and when the SOC first recognizes it; lower values reduce attacker dwell time.
MTTR (mean time to respond)
Time from detection to full mitigation; for this case study MTTR is taken from the incident duration column in the dataset.
Block rate/prevention efficiency
Percentage of malicious traffic blocked before reaching production systems; this shows how effective automated and rule-based controls are.
Total attack volume stopped
Total number of malicious requests or packets the SOC intercepted; useful to show scale and to translate into business risk reduction.
False positive rate
Share of alerts that are not true threats; lower false positive rates reduce analyst fatigue and operational cost.
Coverage rate
Percentage of critical assets (endpoints, networks, cloud workloads, identities) monitored by the SOC; higher coverage means fewer blind spots.
Automation effectiveness
Share of incidents or alerts handled automatically by SOAR/automated controls versus those requiring manual analyst intervention.
Cost of downtime prevented (business metric)
Translate detections and mitigations into avoided business losses using a per-minute or per-hour downtime cost; this helps justify spending to finance stakeholders.
How to collect these metrics
- SIEM and telemetry exports for timestamps, alert IDs, and volumes.
- SOAR logs for automation and playbook success rates.
- Ticketing system (ServiceNow, Jira) for timestamps on detection, escalation, and closure.
- WAF/reverse proxy and edge logs for exact blocked request counts.
- Regular reporting templates (daily/weekly/monthly) to aggregate and visualize trends.
Example SOC case study (week’s worth of data)
Overview
A SOC as a Service engagement monitored several customer-facing assets during one week in September and captured multiple DDoS events; the dataset used here is directly taken from operational logs and was anonymized for publication.
| Target | Duration (MTTR) | Total requests | Blocked % | Attack type |
|---|---|---|---|---|
| Target A | 9 minutes | 53,999,459 | 100% | DDoS |
| Target B | 6 minutes | 6,487,919 | 99% | DDoS |
| Target C | 7 minutes | 3,499,860 | 93% | DDoS |
Calculated results (week total)
- Total malicious requests observed: 63,987,239 (rounded)
- Estimated requests blocked: 63,677,371 (rounded)
- Weighted overall block rate: approximately 99.5%
- Average MTTR (using durations): 7.3 minutes
Estimated business impact prevented (assumption explained)
- Assumption used for the example: average downtime cost = €5,000 per minute for affected SMB customers.
- Total duration across the three incidents: 22 minutes (9 + 6 + 7).
- Estimated downtime cost avoided: 22 minutes × €5,000/min = €110,000.
Note: Use your own per-minute cost to produce a tailored number for a specific customer.
What these metrics prove in this example
- Rapid mitigation: average MTTR under 10 minutes, preventing attacker persistence.
- High prevention: near-total blocking of malicious traffic with an overall block rate ≈ 99.5%.
- Tangible business value: a conservative avoided loss estimate of €110,000 for the three incidents combined.
- Zero customer downtime recorded and no SLA breaches during the events.
How buyers should interpret these metrics
- Compare providers using weighted metrics, not simple means; volume matters when computing overall block rate.
- Ask for raw numbers (requests, block percentages, durations) rather than only percentages so you can compute weighted results.
- Validate assumptions for cost estimates with your finance team; downtime cost varies widely by business function.
- Require SOCs to publish methodology: how MTTR is measured, what constitutes a blocked request, and whether human verification was needed.
Final thoughts
Measuring SOC performance with MTTD, MTTR, block rate, volume stopped, and business impact gives both technical and financial clarity; this turns security from a black box into a measurable service that can be compared, improved, and justified to stakeholders.
