Five Ways MSSPs Can Skew SOC Metrics—and How Customers Can Verify Them

Summary

The article describes five ways MSSPs may skew SOC SLA metrics and advises customers to review raw alert data, audit logs, severity changes and escalation timelines. It also cautions that unrealistic SLAs can create harmful incentives.

Key points

• Severity downgrades can extend response deadlines; require justification for severity changes.
• Restarting SLA timers at each escalation can hide total response delays; track continuously from the alert’s initial generation.
• Including automatically handled alerts can make time-based averages appear faster; check whether they are excluded.
• Selective reporting may omit alerts that breached SLAs, including weekend alerts; request complete period data and recalculate metrics.
• Vague technical-issue explanations can be checked against audit logs, access records and ingestion dashboards.
• Keep access to raw alert data and review whether SLA targets are realistic, since unrealistic expectations can create incentives to game metrics.

People