A city CISO must brief council on SOAR adoption across the highest-volume municipal alert types. Which reporting approach best supports that executive update?

A city CISO briefing council on SOAR adoption across the highest-volume municipal alert types should report SOAR coverage percentage of the top-10 municipal alert types. That metric answers the executive question in civic terms: of the alert classes that dominate city workload, what share already has working orchestration, and where are the gaps. Coverage percentage forces prioritization—phishing, identity lockouts, endpoint malware, VPN anomalies, and similar high-volume types—rather than celebrating niche playbooks that rarely fire. Council can then fund the next coverage tranche against measured municipal demand. Why the other options fail by concept: Reporting SOAR enrichment-only automation of the top-10 municipal alert types measures partial help that only adds context, not adoption breadth; it does not show what share of those high-volume types actually has working orchestration for council to fund. Reporting SOAR draft playbook inventory of the top-10 municipal alert types counts un-deployed designs, not coverage; it does not show which top-10 municipal alert types are covered and wastes council time on backlog noise rather than security governance. Reporting SOAR lab-tested playbook rate of the top-10 municipal alert types measures validation in a lab, not adoption coverage; executives cannot steer investment without knowing breadth of production coverage. Exam caveat: coverage means playbooks that run successfully in production for that alert type, not merely enrichment-only automation that only adds context without orchestrated response. Operational check: rank municipal alert volume for a representative period, mark each top-10 type as covered/partial/none against live SOAR executions, and present the coverage percentage plus the uncovered types as the next automation backlog for council.