Summary

This chapter provided metrics for calculating both the efficiency and effectiveness of an organization. We started by reviewing a CMMI model to track the maturity of our organization and then identified agile process metrics to track the efficiency of the organization. MTTD was introduced as a common organization-wide effectiveness metric. Some limitations of MTTD were identified, which should be understood when using this metric. Next, we categorized our detections into three tiers, allowing us to identify metrics for each tier that reflect their importance to the organization. Low-fidelity coverage using the MITRE ATT&CK matrix and high-fidelity coverage metrics through validation, detection drift, and volatility were examined as ways to calculate coverage and track how coverage changes over time. In the final chapter, Chapter 12, we’ll wrap up by discussing what a career in detection engineering looks like, how you can progress your skill set, and the future of...