Definitions
Terms used in this paper
These definitions establish how the paper uses its core terms before the argument begins.
- Activity metric
- A measure of SOC or provider work such as alerts processed, cases closed, or analyst response time.
- Outcome metric
- A measure showing whether a material security condition changed, persisted, recurred, or remained unresolved.
- Recurrence
- Return of a previously remediated or closed condition, potentially indicating drift or a failed remediation mechanism.
- Evidence gap
- Missing or stale observation that reduces confidence in the provider's conclusion.
1. Activity metrics are operationally useful but incomplete
An MSSP needs to manage queue depth, response time, analyst workload, escalation, and service-level commitments. Those metrics help run the SOC. They do not necessarily tell the customer whether the environment became safer.
A month with fewer alerts can mean controls improved, telemetry failed, attackers changed tactics, or detection coverage shrank. Outcome metrics need context from the underlying security condition.
2. Measure the conditions that changed after intervention
Outcome-oriented reporting can track verified remediation, recurrence, exposure-window duration, evidence freshness, control-state improvement, and unresolved exceptions. The exact measures should reflect the service and customer priorities.
The report should clearly connect an intervention to what changed afterward rather than present disconnected charts that happen to move in the same month.
- Activity
- Alert volume, queue depth, response time, and cases closed help run the service.
- Outcome
- Validated correction, recurrence, exposure duration, and evidence freshness show what changed for the customer.
Fewer alerts can reflect improvement or lost visibility. Read outcomes together with observation coverage and uncertainty.
3. Recurrence is a high-value managed-service signal
A finding that returns after closure may indicate a broken remediation recipe, configuration drift, image-management problem, identity process, or underlying business constraint. Treating each recurrence as an independent ticket hides the system problem.
MSSPs can use recurrence data to improve automation, recommend architectural changes, and distinguish one-time clean-up from durable risk reduction.
4. Evidence gaps should be reported as service risk
A managed security program cannot confidently measure conditions it cannot observe. Offline agents, broken integrations, stale identity feeds, missing cloud accounts, and incomplete asset inventory all reduce the reliability of the service's conclusions.
Customer reporting should surface those gaps explicitly. An apparently healthy control state with weak observation should not be presented with the same confidence as a well-evidenced state.
5. Outcome metrics improve executive reporting without oversimplifying it
Executives need concise reporting, but simplification should preserve the difference between activity, state, and uncertainty. A useful summary can show what improved, what deteriorated, where evidence is weak, and which risks require customer decisions.
That is a more defensible managed-security story than reporting a large number of alerts as proof of value or a small number of alerts as proof of safety.
Evidence base
Sources and notes
External foundations are kept distinct from VitalSec implementation notes so readers can see what supports the argument independently and what documents the platform implementation.
External foundations and sources
VitalSec implementation notes
These links document how the argument is implemented or described inside VitalSec. They are not offered as independent validation of the paper's thesis.