Which metric describes how thoroughly the OT environment is monitored for anomalies?

Which metric describes how thoroughly the OT environment is monitored for anomalies?

• A. MTTR
• B. False-positive rate
• C. Detection coverage
• D. Coverage of critical assets

Answer: (C)

Detection coverage is the metric that measures how much of the OT environment has anomaly-detection and monitoring in place. It answers how broadly you’re watching for unusual or malicious activity across all devices, networks, and processes in the OT network. When telemetry and detection capabilities exist on a wide range of assets—sensors, PLCs, RTUs, HMIs, and the network segments they run on—you have high detection coverage, signaling thorough monitoring of the environment. This differs from MTTR, which is about how long it takes to recover after an incident, not how widely monitoring exists. It also differs from the false-positive rate, which focuses on the accuracy of the alerts themselves rather than how much of the ecosystem is being observed. And concentrating on coverage of critical assets only looks at the most important items, potentially missing visibility elsewhere in the OT landscape. So detection coverage best describes the breadth of anomaly monitoring across the entire OT environment.

Detection coverage is the metric that measures how much of the OT environment has anomaly-detection and monitoring in place. It answers how broadly you’re watching for unusual or malicious activity across all devices, networks, and processes in the OT network. When telemetry and detection capabilities exist on a wide range of assets—sensors, PLCs, RTUs, HMIs, and the network segments they run on—you have high detection coverage, signaling thorough monitoring of the environment.

This differs from MTTR, which is about how long it takes to recover after an incident, not how widely monitoring exists. It also differs from the false-positive rate, which focuses on the accuracy of the alerts themselves rather than how much of the ecosystem is being observed. And concentrating on coverage of critical assets only looks at the most important items, potentially missing visibility elsewhere in the OT landscape. So detection coverage best describes the breadth of anomaly monitoring across the entire OT environment.