Notifications
Clear all
Topic starter
01/08/2026 10:43 pm
TL;DR: SOC and MDR teams often track speed and cost, but this article argues that alert triage, investigation, and response only become manageable when quality is measured as well, because fast closures without context can hide weak decisions according to AirMDR. The practical shift is toward structured case scoring that makes investigations defensible, repeatable, and improvable rather than intuition-led.
NHIMG editorial — based on content published by Airmdr: Measuring What Matters: Building a Case Quality Metric for SOC and MDR Teams
Questions worth separating out
Q: How should security teams measure SOC case quality?
A: Security teams should measure case quality by scoring whether analysts answered the right questions for the alert type, not by relying on closure speed alone.
Q: Why do MTTD, MTTI, and MTTR fail as standalone SOC metrics?
A: They measure how quickly work moves, not whether the final decision was sound.
Q: What breaks when SOC investigations lack enough context?
A: Investigations without context become hard to defend, hard to audit, and easy to optimize for the wrong outcome.
Practitioner guidance
- Define a case-quality rubric for each alert class Map the critical questions analysts must answer for common alert types, then score investigations on whether those questions were fully answered, partially answered, or missed.
- Weight identity context in investigation scoring Require investigators to record the identities, privileges, service accounts, and delegation paths involved before closing cases that touch authentication, access, or token use.
- Use automation to surface gaps, not just close tickets Configure automated scoring to flag unanswered questions, missing evidence, and low-confidence conclusions so human reviewers can focus on the cases where context is thin.
What's in the full article
Airmdr's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact case-quality rubric logic used to turn analyst questioning into a measurable score.
- The working assumptions behind the SOC Grader approach and how it handles partial evidence.
- The practical examples of how automation and manual QA are combined in day-to-day case scoring.
- The article's suggested framing for using quality metrics in SOC and MDR reporting.
👉 Read Airmdr's analysis of case quality metrics for SOC and MDR teams →
SOC case quality metrics: are your investigations actually defensible?
Explore further
01/08/2026 10:53 pm
Case quality is the missing governance layer in SOC operations. Speed and cost are operational indicators, but they do not tell leaders whether the team reached a defensible conclusion. When quality is unmeasured, organisations can mistake motion for security and throughput for control. For SOC and MDR programmes, that creates governance debt because the service can appear efficient while still producing weak outcomes. Practitioners should treat quality scoring as an operating control, not a reporting extra.
A question worth separating out:
Q: How can organisations balance automation and human review in SOC scoring?
A: Use automation for scale, consistency, and gap detection, then apply human review to cases where the evidence is ambiguous or the impact is high. Automation should identify missing answers and repeatable patterns, while humans validate whether the rubric matches real analyst judgment. That hybrid model keeps scoring useful without turning it into a false proxy for security.
👉 Read our full editorial: Case quality metrics are changing how SOC and MDR teams measure ATIR
