Most security dashboards are built for security engineers. They display alert volumes, detection rates, mean time to respond, coverage percentages, rule firing frequencies, and dozens of other metrics that are genuinely useful — if you have the training to interpret them and the time to do so.
The people who need to make decisions about security in a small organisation are rarely security engineers. They're managing partners, practice managers, finance directors, chief executives. They're responsible for organisational risk, not for reading SIEM output. They need to answer a different question: "Are we protected right now, and how do I know?"
The Confidence Score is our answer to that question.
What the Confidence Score Is
The Confidence Score is a single numeric metric — expressed as a percentage — that represents how well-protected your organisation is at this moment, based on the data the SOC is receiving and the activity being observed. It's updated continuously and displayed on the SOC in a Box client dashboard.
The score is calculated from several weighted components:
- Sensor health: Is the appliance connected and transmitting telemetry? Are all expected data sources reporting? A sensor that's gone dark reduces the score immediately and triggers an alert to the analyst.
- Coverage completeness: What proportion of the assets in scope are currently covered by active monitoring? A laptop that hasn't connected in two weeks reduces coverage and reduces the score.
- Detection rule currency: Are the detection rules current? Has the threat research team updated rules for newly disclosed vulnerabilities relevant to the client's technology stack?
- Open incident status: Are there confirmed incidents or unresolved alerts that require attention? Active incidents reduce the score to ensure they're visible to decision-makers, not just to analysts.
- Baseline stability: How stable is the behavioural baseline? Unusual patterns that haven't yet been classified as incidents or confirmed as benign are reflected in the score.
Why One Number?
The design decision to express the result as a single number was contentious within the team. Security professionals are trained to distrust oversimplification — and rightly so. A single number inevitably loses information.
But we kept coming back to what the score is for. It's not for the analyst — the analyst has the full SOC365 dashboard. It's for the decision-maker who needs to glance at the dashboard during a board meeting and confirm that the answer to "are we secure?" is, broadly, yes. Or who needs to explain to their cyber liability insurer why they should be considered a lower risk. Or who needs to demonstrate to a procurement team that they take security seriously.
A score of 94% out of 100% communicates something clear and actionable. A wall of graphs communicates expertise, but not necessarily understanding.
The score is always accompanied by a plain-English explanation of what's driving it — the component breakdown, in language a non-specialist can read. If the score is 89% because one of the virtual machines hasn't reported telemetry in 48 hours, that's what it says. Not "sensor ID siab-vm-04 has not transmitted heartbeat in T+48h". "One of your covered machines hasn't been seen by the SOC for two days — this might mean it's been switched off, or it might mean there's a connectivity issue worth investigating."
The Monthly Report
The Confidence Score dashboard is complemented by the monthly board-ready report, authored by the named analyst. This isn't a generated document — it's written by the person who's been watching the environment for the past month. It covers what was detected, what was investigated, what was confirmed as benign, what required escalation, and what the analyst recommends for the month ahead.
The report is designed to serve two audiences simultaneously: the business owner who wants to understand what happened in plain English, and the auditor or regulator who wants evidence that continuous monitoring is genuinely in place. The compliance evidence pack — included with the report — is structured specifically to answer the questions that ISO 27001 auditors, FCA supervisors, and NHS Digital assessors typically ask about security monitoring.
The Regulator Question
As we built SOC in a Box, we kept asking ourselves: if a client had to demonstrate to a regulator that they had adequate security monitoring in place, would the Confidence Score and the monthly report be sufficient evidence?
We believe the answer is yes — and we've designed both artefacts with that question explicitly in mind. The ICO's accountability principle requires organisations to be able to demonstrate compliance, not just achieve it. The Confidence Score provides a continuous, timestamped record of security posture. The monthly report provides narrative evidence of active monitoring and analyst judgement. Together, they're the documentation that boards and regulators actually need.
Next week, we're covering the deployment process itself — from order to 24/7 monitoring in five working days. We'll walk through exactly what happens on each of those five days.
Further Reading
A Dashboard Built for Decision-Makers
The Confidence Score tells your board what they need to know. Your named analyst tells your auditors what they need to see. Both are included with every SOC in a Box deployment.
See a demo