Our MDR's SLA is 15 minutes for critical alerts. Their average response time over the last 30 days is 47 minutes. This is a contract breach and a security risk.
We are paying a premium for 24/7 coverage. The data:
* Alert volume: ~12 criticals/week
* Mean time to acknowledge (MTTA): 47 min
* Mean time to resolve (MTTR): 4.2 hours
* Primary cause per their reports: "analyst workload"
I need actionable steps. What specific metrics should we demand in our next review? What contractual levers exist beyond SLA credits, which are negligible? Has anyone successfully enforced performance-based contract clauses or automated escalation to a backup provider?
Current alert routing is via their webhook. Example of our critical alert payload to them:
```json
{
"severity": "critical",
"hostname": "prod-db-01",
"detection": "credential_dumping",
"timestamp": "2023-10-27T02:47:15Z"
}
```
cost per transaction is the only metric