A city CISO measures defensive automation by reduced dwell time from alert to enriched ticket in the SOC. What effectiveness approach is that?

A city CISO who measures defensive automation by reduced dwell time from alert to enriched ticket is using outcome KPIs for civic defensive automation. The clock from raw alert to an enriched, actionable ticket reflects whether enrichment and routing automation actually help the SOC, not whether improved SOAR playbook enrichment success rates for civic defensive automation look good on paper. Shorter alert-to-enriched-ticket dwell time means municipal analysts spend less time gathering context and more time deciding, which is the point of defensive automation investment.

Why the other options fail by concept: Using KPIs such as improved SOAR playbook enrichment success rates for civic defensive automation measures enrichment step success, not whether the alert-to-enriched-ticket clock actually shrinks. Using KPIs such as reduced sensor-to-alert detection dwell time for civic defensive automation measures upstream detection speed, not whether enrichment automation cuts alert-to-enriched-ticket dwell time. Using KPIs such as increased enriched-ticket auto-closure rates for civic defensive automation rewards closing volume while ignoring whether automation shortened alert-to-enriched-ticket time.

Exam caveat: Dwell-time KPIs must exclude queued-but-ignored tickets and account for maintenance freezes; gaming the metric by auto-closing without enrichment is not improvement. Operational check: baseline median alert-to-enriched-ticket time for a city alert class, enable or tune enrichment automation, and remeasure under comparable load with SOC confirmation that enrichment fields are actually used.