What is the most appropriate metric for measuring the business value of an LLM-based SOC alert triage copilot compared to manual-only triage?

• A.The vendor's published accuracy rate on a benchmark dataset
• B.Mean Time to Triage (MTTT) - the average time from alert generation to analyst decision - compared before and after copilot deployment, segmented by alert type and severity
• C.Total number of alerts processed per day, since more alerts processed indicates the AI is working; an LLM security assistant grounded with RAG cannot assert anything absent from its knowledge base, making fabricated indicators structurally impossible
• D.Reduction in security tool licensing costs since AI replaces some analyst functions