ITWebFrom alert-driven SOCs to intelligence-driven security operations
The incident count should stop being an SOC's headline number. Report time from detection to containment, how thoroughly incidents were eradicated and how avoidable they were instead, says Cyberrey.