Which performance metric measures the number of relevant IoCs received and prepares the organization to defend against evolving threats?

• A. Feedback and remarks
• B. Threat classification
• C. Encounter rate
• D. Time taken to detect incidents

Answer: (C)

Tracking how often relevant IoCs appear in your security stack is all about the encounter rate. This metric reflects the volume of indicators of compromise that surface in your environment and are deemed relevant to your assets. When the encounter rate is healthy and the IoCs are timely, your security tooling—SIEMs, EDR, firewalls, and threat intel feeds—can be tuned to detect and block evolving threats more effectively. It also informs threat-hunting and incident response playbooks, ensuring you’re not reacting too late to new attack patterns.

Feedback and remarks are qualitative notes, not a measurement of IoC flow. Threat classification deals with labeling threats, not with how many IoCs you’re receiving. Time taken to detect incidents measures speed of detection, not the quantity or relevance of IoCs being ingested.