Which metric helps determine how quickly security responds to a security incident?

• A. Number of staff
• B. Response time
• C. Patrol coverage
• D. Time of day

Answer: (B)

Measuring how fast security acts after an incident is about the response time. This metric is the elapsed time from when the incident is detected or an alert is raised to when the security team begins to respond or containment starts. It directly captures how quickly the organization can react, which is the heart of incident responsiveness. Shorter response times indicate a more agile and effective incident-handling process, while longer times point to delays that can increase risk or damage.

Why the other options don’t fit as well: the number of staff tells you about resources and capacity, not speed of action; patrol coverage indicates how much area is monitored, not how fast you can respond to an incident; time of day can influence responsiveness due to staffing or conditions but doesn’t itself measure how quickly you respond. For practical use, you’d track average and median response times to set targets and drive process improvements, such as reducing time between detection and intervention.