During security steering committees (Copil Cyber), SOC directors or managed service providers (MSSP) proudly present their dashboards. Very often, one metric shines at the center of the presentation: theResolution Rate. With scores regularly showing 95%, 98% or even 99% of resolved incidents, the audience is reassured. Security is under control.
However, behind these flattering figures often hides a statistical lie. A resolution rate approaching 100% in a modern XDR (Extended Detection and Response) environment is a symptom of a structural mathematical error that masks the true effectiveness (and exhaustion) of your teams. Let’s decipher this bias and see how to reestablish the truth.
The problem of the classic formula (The Vanity Metric)
In 90% of security operations centers that use a standard IT ticketing tool, the Resolution Rate is calculated using the most basic formula possible:
Resolution Rate = (Tickets Closed / Total Tickets Created) x 100
If your Microsoft Defender generates 10,000 alerts in the month, and your analysts manage to "close" 9,500 of these alerts, the dashboard displays a rate of 95%. The team seems to be performing extraordinarily well.
But what is the nature of these 9,500 closed tickets?
In the reality of a SOC, nearly 70% to 80% of the alerts generated by behavioral algorithms areFalse Positives. A developer launching a legitimate script, a traveling salesperson logging in from a new country, an internal vulnerability scan... All of this generates alerts.
Analysts therefore spend their days closing harmless tickets by clicking “Archive”. By including these thousands of false positives in the “Closed Tickets” box, the classic formula artificially inflates the success percentage. It's aVanity Metric(vanity metric).
The risk of false security
This mathematical bias has two disastrous consequences:
- Exhaustion ignored:Management thinks the team is hyper-productive, when in reality, analysts are victims of Alert Fatigue. They spend their time sorting through noise rather than hunting real threats (Threat Hunting).
- Blindness to the threat:If out of the 10,000 tickets, only 50 were real attacks (True Positives), and the team only had time to process 25 before the end of the week, the reality is that50% of real attacks have not been resolved. Yet, diluted in the noise of false positives, the overall dashboard will still show a reassuring 98%.
The real formula: Akuity SOC Resolution Rate
To provide healthy and honest governance to CISOs and MSSPs, the orchestratorAkuity SOCcorrected this mathematical heresy. The analysis dashboard (KPIs & Analysis) never mixes noise and signal.
In Akuity, the “Resolution Rate (%)” of the Scorecard calculates the actual ratio of incidents handled compared to incidentslegitimate. The algorithmic formula is as follows:
Actual Resolution Rate = Resolved / (Total - False Positives recognized)
How does AI make this metric possible?
For this formula to work, you must be able to separate False Positives from True Positives very quickly.
- The Gemini AI intervenes upstream (out-of-band). It qualifies the alerts and places the “Probable False Positive” badge on the background noise.
- The analyst confirms with one click via theToggle Switchfrom the ticket panel.
- As soon as the status changes to False Positive, the incident is subtracted from the denominator (the Total) of the performance formula.
If Microsoft generates 100 alerts, the AI and human mark 80 of them as False Positives, and the team resolves 15 of the remaining 20 True Positives, the Akuity Scorecard will display75%. This figure, much less flattering than 95%, is the raw truth. It is on this truth that we build a resilient defense strategy and adjust the strength of the SOC.
Conclusion: Fly with the truth
Don't let algorithmic noise dictate your strategic cybersecurity vision. A decision-making dashboard should not flatter the ego, it should illuminate the flaws in your processes. By measuring the effectiveness of your teams exclusively on proven threats, you give meaning to their work and a real compass to your Executive Committee.
Want to manage your security with reliable data?> Discover ourNext-generation SOC dashboards and KPIsand take back control of your statistics.