Two security experts debate how to measure AI's impact in SOCs. They focus on MTTR, human touches, and automation of detections and response playbooks, arguing that reducing mean time to respond matters because threat actors are already using AI.
Chapters
I feel like the AI fatigue is not a thing because ultimately what I want to say is people are obsessing about MTDD and MTTR, and occasionally that leaves them in a really odd place, which maybe isn't very productive. I have nothing against measuring this. I have some things against judging people for that. But what are the metrics we can use for the agentic solving? Isn't it a perennial theme? We had it in many episodes.
Yeah. The metrics we have today are still going to be really important. I think we also want to be thinking about the number of human touches on cases. What, you know, how automated is our detections and our response playbooks? I think the one that's going to be really key is mean time to respond. Like, we've got to get that number down. Respond. Just because at the speed at which we think, we assume threat actors will be using AI within client networks.