Research | Our Q3 report details what's new in the world of ransomware.
Reduce Alert Noise and False Positives
Boost your team's productivity by cutting down alert noise and false positives.
Automate Security Operations
Boost efficiency, reduce burnout, and better manage risk through automation.
Dark Web Monitoring
Online protection tuned to the need of your business.
Maximize Existing Security Investments
Improve efficiencies from existing investments in security tools.
Move your security operations beyond the limitations of MDR.
Secure with Microsoft 365 E5
Boost the power of Microsoft 365 E5 security.
Secure Multi-Cloud Environments
Improve cloud security and overcome complexity across multi-cloud environments.
Secure Mergers and Acquisitions
Control cyber risk for business acquisitions and dispersed business units.
Solve security operations challenges affecting critical operational technology (OT) infrastructure.
Force-Multiply Your Security Operations
Whether you’re just starting your security journey, need to up your game, or you’re not happy with an existing service, we can help you to achieve your security goals.
Detection Investigation Response
Modernize Detection, Investigation, Response with a Security Operations Platform.
Locate and eliminate lurking threats with ReliaQuest GreyMatter
Find cyber threats that have evaded your defenses.
Security metrics to manage and improve security operations.
Breach and Attack Simulation
GreyMatter Verify is ReliaQuest’s automated breach and attack simulation capability.
Digital Risk Protection
Continuous monitoring of open, deep, and dark web sources to identify threats.
GreyMatter Phishing Analyzer removes the abuse mailbox management by automating the DIR process for you.
The GreyMatter cloud-native Open XDR platform integrates with a fast-growing number of market-leading technologies.
Unify and Optimize Your Security Operations
ReliaQuest GreyMatter is a security operations platform built on an open XDR architecture and designed to help security teams increase visibility, reduce complexity, and manage risk across their security tools, including on-premises, clouds, networks, and endpoints.
Brands of the world trust ReliaQuest to achieve their security goals.
Learn how to achieve your security outcomes faster with ReliaQuest GreyMatter.
The latest security trends and perspectives to help inform your security operations.
Industry Guides and Reports
The latest security research and industry reports.
Catch up on the latest cybersecurity podcasts, and mindset moments from our very own mental performance coaches.
A deep dive on how ReliaQuest GreyMatter addresses security challenges.
The latest threat research report from ReliaQuest Threat Research research team.
The latest white papers focused on security operations strategy, technology & insight.
Current and future SOC trends presented by our security experts.
Events & Webinars
Explore all upcoming company events, in-person and on-demand webinars
From prevention techniques to emerging security trends, our comprehensive library can arm you with the tools you need to improve your security posture.
Get the latest threat analysis from the ReliaQuest Threat Research Team. ReliaQuest ShadowTalk Weekly podcast featuring discussions on the latest cybersecurity news and threat research.
ReliaQuest's ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk's hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week's top cybersecurity stories.
November 30, 2023
We bring our best attitude, energy and effort to everything we do, every day, to make security possible.
Security is a team sport.
No Show Dogs Podcast
Mental Performance Coaches Derin McMains and Dr. Nicole Detling interview world-class performers across multiple industries.
Make It Possible
Make It Possible reflects our focus on bringing cybersecurity awareness to our communities and enabling the next generation of cybersecurity professionals.
Join our world-class team.
Press and Media Coverage
ReliaQuest newsroom covering the latest press release and media coverage.
Become a Channel Partner
When you partner with ReliaQuest, you help deliver world-class cybersecurity solutions.
How can we help you?
A Mindset Like No Other in the Industry
Many companies tout their cultures; at ReliaQuest, we share a mindset. We focus on four values every day to make security possible: being accountable, helpful, adaptable, and focused. These values drive development of our platform, relationships with our customers and partners, and further the ReliaQuest promise of security confidence across our customers and our own teams.
In today’s digital landscape, organizations continuously face cybersecurity threats. With ever-evolving cyber risks, it is critical for security and business leaders to understand and effectively communicate the true state of their cybersecurity posture to drive decisions.
By tracking and monitoring the right cybersecurity metrics around detection, investigation, and response (DIR) workflows, organizations can accurately assess their security posture and optimize their security operations. Measuring key performance indicators (KPIs) and analyzing relevant data enables organizations to gain actionable insights into their security landscape and identify areas for improvement.
In this blog, we will delve into the critical security operations metrics that matter. These metrics offer a comprehensive view of an organization’s proficiency in the DIR workflow, enabling them to efficiently identify, analyze, and counter potential cyber threats.
CISOs leverage metrics to effectively communicate the state of their cybersecurity program, enabling informed discussions among executive and board conversations around business and cyber risk. By providing comprehensive information, CISOs help organizational leadership understand the trendlines and gauge the maturation and performance of their security program relative to company peers. For example, is the Mean Time to Resolve (MTTR) security incidents trending downward? Is the organization performing better than peer companies?
Security leaders typically use metrics to establish and refine security strategy and maturity, particularly around the threat detection, investigation, and response process. The right metrics inform investment decisions or resource allocations to control risk. For instance, evaluating MITRE ATT&CK detection coverage can reveal opportunities where additional visibility or more detection capability might be required.
Security practitioners and analysts need metrics to inform tactical decisions to better manage day-to-day security operations decisions as they investigate and respond to incidents. For example, tracking the use of response playbooks can uncover opportunities to automate response and remediation actions and processes. If analysts frequently encounter a particular phishing alert, they can implement an automated response play leveraging existing tools. This accelerates response and saves analysts from swiveling between consoles.
1. Data Source Visibility: This metric enables organizations to understand the percentage of your environment that you can see compared to all the data sources you might expect to see. Improving data source visibility enables organizations to strengthen their ability to proactively detect and respond to potential security incidents.
To help you gain an understanding of your visibility level, consider the following questions:
2. Data Source Diversity: Data source diversity ensures comprehensive threat visibility by tracking the distinct data source functions that are available and enabled to improve monitoring fidelity. Leveraging these data sources provides a broader view of attack patterns, reduces false positives, and enables a proactive approach to your cybersecurity.
To determine the diversity of your data sources, reflect on the following questions:
3. MITRE ATT&CK Coverage: By aligning with MITRE ATT&CK, organizations can comprehensively assess their detection capabilities and identify areas for improvement. MITRE ATT&CK covers several attack techniques, enabling organizations to prioritize defense measures based on real-world scenarios and known adversarial behaviors and strengthen their detection capabilities against a variety of cyber threats. This coverage allows you to compare deployed techniques against total possible techniques available based on the technologies that you own.
Consider the following questions when assessing if your organization aligns with MITRE:
4. False-Positive Rate: Measuring your false-positive rate can help you assess alert noise. Eliminating false-positives saves time during investigations and ensures resources are focused on real threats rather than false alarms triggered by benign events. This metric can enhance the effectiveness of security teams by reducing alert noise and improving incident response.
Answering the following questions can help you get a good sense of how your team is performing:
5. Anomalous Safe Rate (ASR): ASR is a key investigation metric measuring the accuracy of alerts. Anomalous-safe alerts are alerts where the activity has been judged to be safe, but the same activity can sometimes be malicious.
A low ASR score reduces false alarms, allowing security teams to prioritize legitimate threats and allocate resources efficiently. Monitoring ASR helps organizations evaluate system reliability and make necessary improvements.
To help you gain an understanding of your ASR level, consider the following questions:
6. Threat Hunting Success Rate: Threat hunting metrics can uncover patterns and trends in malicious activities, allowing teams to move from reactive to proactive. They serve as a measure of proactive security, identifying weaknesses or holes in a security program.
Consider the following questions when assessing your threat hunting metrics:
7. Mean Time to Resolve (MTTR): These metrics evaluate the time it takes an organization to resolve an incident. It is worth noting that some people measure “respond” rather than “resolve” and you should be clear on your definition. “Resolve” typically means “incident closed,” where “respond” may mean “my security provider responded by notifying me of an incident.” By tracking MTTR, you can reduce the amount of time an attacker can dwell in your environment. Comparing MTTR scores across time periods helps assess the effectiveness of response strategies and demonstrate incident response capabilities.
To gain insight on how your MTTR affects your response efforts, consider the following:
8. Close Rate: Close rate metrics measure the percentage of incidents successfully closed within a given timeframe, allowing organizations to evaluate the performance of their response teams and where they’re spending their time. By analyzing incidents with lower close rates, organizations can understand the underlying causes of delays or challenges, leading to the identification of process inefficiencies, resource gaps, and training needs.
To determine the effectiveness of your close rate during response, consider the following questions:
9. Playbook Execution: Response playbooks can reduce threat dwell time and speed MTTR. To assess the effectiveness of executing predefined response playbooks during incident response, organizations need to consider playbook execution metrics. This metric helps uncover opportunities to automate response and remediation actions and processes. By tracking playbook execution, organizations can improve response processes, identify areas for further automation, and effectively communicate their incident response capabilities to stakeholders.
Answer the following questions to evaluate the effectiveness of your playbook execution:
Tracking the right cybersecurity key performance indicators (KPIs) offers benefits to various audiences, from the board to cybersecurity leadership to the analyst team. These metrics provide a clear overview of an organization’s security posture, measure the effectiveness of cybersecurity initiatives, and facilitate tactical process improvements, ultimately enabling strategic and tactical decision-making. Leveraging the right cybersecurity KPIs promotes continuous improvement by tracking progress, identifying areas for enhancement, and managing risk.
Cybersecurity dashboards offer an intuitive and consolidated view of the organization’s security posture, providing clarity and communicating the effectiveness of their security operations. They empower you to communicate risk by highlighting emerging threats, enabling the team to stay ahead of potential security incidents. Dashboards present risk data concisely, making it accessible and relevant to board members, bridging the gap between technical details and strategic decision-making.
As a dashboard, the GreyMatter Security Model Index helps improve reporting and gives security leaders real-time views into critical areas of security operations. Model Index metrics are benchmarked against previous quarters and industry peers, giving measurable insights into how your program is performing comparatively and maturing over time. It ensures effective communication of the value your security operations bring to the organization and helps you to improve your security maturity over time.
Get a live demo of our security operations platform, GreyMatter, and learn how you can improve visibility, reduce complexity, and manage risk in your organization.