Measuring SOC performance: Why your team’s confidence might hide the real gap

Ninety-three percent of physical security leaders say they’re confident their program would detect a coordinated threat.

That number sounds great. It also happens to be nearly meaningless.

We surveyed 300 security professionals at U.S. organizations with 500+ employees and an established SOC (or concrete plans to build one). We asked them how they’d rate their programs. We asked how confident they felt. And then we asked something harder: How often do you actually meet your own SLAs?

The answer: 19%.

Only 1 in 5 organizations always meets their service level agreements for incident response time, alarm processing rate, and time to resolution. The other 81% fall short of their own commitments at least some of the time. More than 40% miss them often enough that “sometimes” or “occasionally” was the most honest answer they could give.

Confidence runs 74 points ahead of actual performance.

You can’t effectively manage physical security operations without measuring them

Most security teams don’t have reliable mechanisms to track SLA performance.

When teams can’t measure consistently, they fill the gap with confidence. The program feels mature because the team is experienced, the technology is in place and the SOC is running. Everything seems fine because there’s no clear signal that it isn’t.

That’s not negligence. It’s a systems problem. And it’s the most important finding in our research on physical security operations management.

The same teams processing 342 alarms a day – roughly 1 in 3 of which is false, meaning more than 100 noise events arrive before a real alarm – still report near-universal confidence in catching a true incident.

Larger organizations hit 421+ daily alarms, with a self-reported false alarm rate approaching 44%. (Within our customer base we find this to be closer to 80-90%.) That volume alone should create doubt. But without consistent SOC measurement against defined standards, it’s difficult to tell what’s accurate.

Structure amplifies this gap between confidence and reality. Among organizations with centralized or consolidated SOCs, 98% report confidence. That sounds like a good sign. Until you remember that program structure is one of the strongest predictors of confidence regardless of how the program actually performs. Feeling organized isn’t the same as being effective.

Five questions to ask to properly measure SOC performance

If you want to move toward data-driven security operations — where performance is measured, not assumed — start here.

1. What are our SLAs, and are they written down? Not “roughly” or “in someone’s head.” Create specific, documented targets for incident response time, alarm processing rate, and time to resolution. SLAs in security operations centers only work when they’re defined well enough to measure against; make sure everyone knows what they are.
2. How often do we actually hit them? Remove the guesswork by pulling the data. If you can’t answer this question from a report, that’s your answer. A data-driven security program starts with tracking, not gut checks.
3. What percentage of our daily alarms are false positives? According to our research, the industry average is 32.5% (and in our experience, can jump to as much as 90% false). At enterprise scale, it climbs to 44%. If your SOC doesn’t know its false alarm rate, operators are triaging noise without knowing how much of their shift is real work.
4. What are our operators doing that automation could do instead? In our study, the top two tasks operators wanted to eliminate were manually triaging alarms (22%) and sending routine notifications and escalation emails (28%). Half your team’s bandwidth is going to work that shouldn’t require a human. Is yours?
5. Where does our self-assessed maturity diverge from our SLA data? If you rate your physical security operations management at Level 3 or Level 4 but you’re only hitting SLAs occasionally, that’s the gap worth investigating. Maturity and performance aren’t the same thing, and this research proves it.

These five questions won’t fix anything by themselves. But they’ll tell you whether your confidence is grounded or whether you’re operating with the same blind spot we found across most SOCs in the industry.

The most effective programs aren’t working harder. They’re measuring what matters, supporting operators by automating what doesn’t need a human, and building data-driven security operations that keep pace with their scale.

That’s what closing the confidence gap actually looks like.

Where does your security program stand?

Download the full State of Physical Security Operations in 2026 report, including benchmark data on false alarm rates, AI adoption, SOC maturity levels, and SLA attainment across 300 security programs.