Median metrics describe the typical alert, not the alerts that sit at the edge of the queue during peak load. Those tail events are where attackers gain the most usable time. A SOC can look efficient on paper while still leaving critical signals untouched long enough for compromise to spread.
Why the median hides the queue that matters
A median is a center-of-distribution measure, so it tells you what the “typical” alert looks like, not what happens when volume spikes and the queue starts to age. In a SOC, that distinction matters because operational risk is usually created by the slowest-handled, highest-consequence alerts, not the average one.
When analysts are saturated, the median can stay stable while the tail grows longer. That means the metric can improve at the same time the environment becomes easier to exploit, because critical signals are waiting behind routine noise.
Why tail latency is a security problem, not just an efficiency problem
The real risk is not simply backlog size, it is dwell time for the subset of alerts that are most likely to represent active compromise. If a high-value signal sits at the edge of the queue during peak load, an attacker gets more uninterrupted time to move, persist, or exfiltrate before anyone reacts.
This is why “fast on average” can be misleading. A SOC can clear benign alerts quickly and still fail to detect the few events that matter most, especially if the alert stream is bursty, the triage workflow is brittle, or handoffs slow down under pressure.
Median metrics also flatten important differences in alert quality. A low-severity phishing event, a routine policy violation, and a lateral-movement indicator do not create the same operational exposure, even if they arrive at similar speed. Practitioners need metrics that preserve priority, aging, and consequence, not just a central tendency.
What to measure instead of relying on the median alone
The useful question is not “how fast do we handle alerts overall?” but “how fast do we handle the alerts that create the most risk when delayed?” That pushes the measurement model toward queue aging, percentile-based latency, breach or incident dwell time, and time-to-triage for priority classes.
- Track p90, p95, and worst-case handling time alongside the median so tail behaviour is visible.
- Separate high-fidelity signals from background noise so priority alerts are measured on their own queue path.
- Measure how often critical alerts exceed an acceptable age threshold during peak load, not just how many were closed.
- Review whether staffing, escalation rules, and automation actually reduce tail delay, or only improve the average.
Risk and Threat Considerations
Median-centric reporting creates a false sense of control because it hides concentration at the slow end of the queue. That is exactly where attacker dwell time expands, where detection gaps become exploitable, and where a small number of delayed alerts can dominate the real exposure. See ENISA Threat Landscape for broader threat patterns that benefit from delayed detection.
Failure mechanism: Alert surges, triage bottlenecks, or weak prioritisation push critical events into the tail, while the median remains anchored by routine alerts that are easy to process.
Impact: Attackers gain extra time to establish persistence, move laterally, or complete exfiltration before the SOC reaches the alerts that would have changed the outcome.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Tail delay increases attacker time to use stolen access and persist. |
| Recommendation — Map delayed critical alerts to ATT&CK credential and persistence techniques, then tune detections for dwell-time reduction. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Queue ageing weakens continuous monitoring when alerts go unreviewed. |
| Recommendation — Measure monitoring latency for priority alerts, not just overall closure rates. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Alert queues depend on timely visibility into events and anomalies. |
| Recommendation — Ensure logging and alert review processes expose aged critical events before they age out. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | SOC queue performance directly affects timely review and escalation of audit events. |
| Recommendation — Review and escalate audit events by priority so critical alerts cannot hide behind median performance. | ||
Practitioner Guidance
What to prioritise: Replace “average handling time” as the headline SOC metric with a small set of measures that expose queue risk, especially percentile latency for high-severity alerts and the age of the oldest unresolved critical event.
What to verify: Confirm that your alert pipeline preserves severity and business impact all the way from detection to assignment. If high-priority alerts share the same workflow as low-value noise, the median will look healthy long before operational risk is under control.
Decision rule: If the median is good but the p95 or oldest-alert age is drifting upward, treat that as a control failure, not a reporting nuance. The organisation is probably optimising throughput while quietly increasing exposure.
Practitioner takeaway: The metric that matters is the one that reveals how long a critical signal can sit untouched when the SOC is under stress, because that is where real compromise windows are created.
Related resources from NHI Mgmt Group
- Who is accountable when phishing resilience programs rely on weak metrics and miss real risk?
- How should SOC teams prioritize metrics that reflect real risk reduction rather than alert volume?
- Why do board-level resilience updates often miss the real operational risk?
- Why do periodic access reviews miss the real NHI risk?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org