14 Questions Are All You Need

The talk starts from a question many security operations leaders struggle to answer: how well is the SOC really doing? The speaker argues that the common measurement frameworks are long, with hundreds of questions, and that a leader should be able to reach a credible picture in a short conversation. Rather than prescribing fixed targets, the talk offers a set of measures, explains the intent behind each one, and suggests that rough estimates can be nearly as useful as heavy data collection.

The first group covers growth. It asks how long staff stay in the same role doing the same work, how many procedures and playbooks have been refreshed recently, whether engineering sits close enough to the SOC to respond quickly, and how complete and accurate monitoring coverage and asset inventory are. The second group covers performance. It looks at the health of the incident funnel, false positive and true positive rates, the share of incidents the SOC finds on its own, whether investigations can be answered with the data available, containment readiness, and how well threat intelligence leads to action. The speaker also flags organizational problems such as split responsibilities and repeated reorganizations.

The takeaway is that these questions work as prompts for conversation and prioritization, not as a scorecard to compute exactly. Teams should set their own targets, accept that monitoring will never be complete, and use the answers to focus effort and explain the SOC's needs to leadership.