A question you cannot answer quickly
A managed client's head of IT asks, a week before their renewal, whether you met your response targets last quarter. Their contract says critical alerts are acknowledged within a set time around the clock, high alerts within a longer time during business hours, and so on. Your answer should be a report. Instead it is a couple of days of an analyst exporting tickets from the PSA and alerts from the SIEM, matching them up, and working out which clock applied to which alert.
Along the way they find problems. Some alerts were acknowledged in the SIEM console but the ticket was opened later, so the PSA shows a slow response that did not really happen. Some high alerts arrived on a Sunday, when the contract only counts business hours. A few were genuinely slow, during a busy night shift.
The report goes out. It is probably right. Nobody would want to bet the renewal on it.
And the genuinely slow ones were found months after the fact, when nothing could be done about them except explain.
Why targets are hard to measure
- Every client contract has its own targets, severities and hours of cover.
- The clock starts at detection in one tool and stops at acknowledgement or response in another.
- Severity sometimes changes during triage, which changes the target that applies.
- Business hours, bank holidays and client-specific time zones affect when the clock runs.
- PSA reporting measures ticket times, which may not be what the contract measures.
What not knowing costs
| Blind spot | Consequence |
|---|---|
| Near misses not visible live | Targets missed that could have been met |
| Wrong clock used in reports | Performance overstated or understated |
| Manual quarterly reports | Analyst days lost before each renewal |
| Pattern of slow nights not spotted | Staffing problem continues |
| Service credits unclear | Disputes with clients about what is owed |
Targets are what a managed security client is paying for. If you cannot show them clearly, the client has to take your word for it, and at renewal that is not enough.
The target tracking we build
- Each client's contract terms are recorded as rules: severities, targets for acknowledgement and response, hours of cover, holidays and time zone.
- Alerts and incidents are read from your SIEM, EDR and PSA by API, and linked so that one timeline shows detection, acknowledgement, response and closure, whichever tool each step happened in.
- The right target is applied to each alert, including any severity change during triage, and the clock runs only when the contract says it should.
- A live view for the shift shows open alerts approaching their target, so the team can act before the target is missed rather than after.
- Monthly and quarterly reports per client show performance against each target, with every miss listed and a space for the reason.
- Where your contracts include service credits, the report shows which misses may be relevant, for your team to review under the contract terms.
We check with you how each step is recorded in your tools before building. Where a step is not recorded anywhere, we say so and suggest the smallest change that captures it.
What the SOC and account leads see
The shift lead sees targets approaching in real time. The SOC manager sees patterns, such as which shifts or alert types miss most often, which points to staffing or tuning. Account leads have a report per client, generated rather than built, that they can put in front of a client with confidence.
When a client asks at renewal whether you met your targets, the answer is a report you already have, with the misses explained. That is a much better conversation than a promise to look into it.
New contracts benefit as well. When sales propose tighter targets to win a deal, the history shows whether your team can meet them on the relevant shifts, before the promise is signed.
Signs you need this
- Nobody can say, today, whether you met each client's targets last month.
- Performance reports are built by hand before renewals.
- PSA ticket times are used as a stand-in for contract response times.
- Near misses are only noticed after the fact.
- Different clients' targets are tracked the same way.