A city SOC wants a SOAR success metric that reflects analyst minutes saved on each phishing case. Which measurement approach best supports that municipal efficiency goal?

A city SOC that wants SOAR success to reflect analyst minutes saved on each phishing case should track analyst minutes saved per phishing case as the primary efficiency metric. That measurement ties orchestration value to municipal labor relief: fewer minutes of repetitive triage, enrichment, and notification work per ticket means the playbooks are actually shrinking civic busywork rather than merely existing. Council and SOC leadership can compare before/after case effort, prioritize playbook investment where minute savings are largest, and defend automation spend with operational outcomes instead of vanity counts.

Why the other options fail by concept: Estimating analyst minutes saved per phishing case from end-to-end ticket closure duration confuses elapsed closure duration with hands-on labor saved — closure duration includes queueing and idle wait, so cases can close faster or slower while analysts still spend the same repetitive minutes on triage, enrichment, and notification, and it does not show municipal efficiency gains. Calculating analyst minutes saved per phishing case using automated playbook run time logs substitutes machine execution time for labor measurement — logs show how long the automation ran, not how many manual minutes were avoided, so fast or slow runs can coexist with unchanged triage, enrichment, and notification effort, and it does not prove how many repetitive minutes per phishing case were actually removed from civic busywork. Deriving analyst minutes saved per phishing case from mailbox message exposure interval substitutes threat exposure duration for case effort — exposure interval from delivery to mailbox remediation can improve while phishing ticket handlers still spend the same repetitive minutes per case, so it does not measure analyst minutes saved.

Exam caveat: minutes-saved metrics must use a consistent definition of case start/end and exclude unrelated wait time, or gaming and apples-to-oranges comparisons will appear across teams. Operational check: instrument phishing playbooks to log analyst touch time before and after SOAR steps, sample a municipal week of cases, and brief council with mean minutes saved per phishing case alongside any residual manual exceptions.