Which of the following is NOT typically used as a security metric?

• A. Mean Time To Detect
• B. Incident Counts
• C. Mean Time To Respond
• D. Customer Satisfaction

Answer: (D)

Security metrics aim to gauge how effectively threats are detected, contained, and how often security events occur. Mean Time To Detect measures how quickly a breach or incident is identified, which is crucial for limiting damage. Mean Time To Respond tracks the speed of containment and remediation once a threat is found, reflecting the organization’s ability to act. Incident Counts show the volume or frequency of security events, helping to assess risk trends and resource needs over time.

Customer Satisfaction, while important for overall service quality and user experience, does not directly reflect security performance. It can be influenced by many factors outside security, such as usability, performance, or policy choices, and therefore isn’t a direct indicator of how well security controls are detecting or stopping threats. Hence, it’s not typically used as a security metric.