CyberCertPrepAI Security FundamentalsAI for Cyber DefenseEASYFree question
What is the most appropriate metric for measuring the business value of an LLM-based SOC alert triage copilot compared to manual-only triage?
- A.Reduction in security tool licensing costs since AI replaces some analyst functions
- B.Total number of alerts processed per day, since more alerts processed indicates the AI is working
- C.The vendor's published accuracy rate on a benchmark dataset
- D.Mean Time to Triage (MTTT) - the average time from alert generation to analyst decision - compared before and after copilot deployment, segmented by alert type and severity
Why D is correct
Mean Time to Triage (MTTT) directly measures the operational value of AI assistance - does the copilot help analysts make faster, more informed decisions? It should be segmented by alert type (phishing, lateral movement, etc.) and severity to identify where the AI adds the most and least value. Total alerts processed reflects volume, not quality or speed of decisions. Vendor benchmark accuracy on a held-out dataset does not reflect real-world performance on the organization's specific alert mix and environment. Cost reduction is a secondary metric that may not materialize if analysts use the saved time on higher-value work rather than reducing headcount.
Know someone studying for AI Security Fundamentals? Send them this one.