The problem

The triage dashboard tracked individual performance hour by hour. Helping a teammate with their alerts hurt your own numbers, so the metric was quietly discouraging analysts from working together, which is the opposite of what you want in a security operations team.

What I did

I raised it with Tier 1 management and proposed changing how we measure, so the numbers reward collaboration and quality instead of penalizing them.

Result

The metric itself couldn't be changed; I was told the option didn't exist. So I changed the procedure instead. Now the engineer starting the next hour rolls their time window back one hour and picks up any loose events the previous engineer didn't get to. Nothing falls through the gap between hours, and nobody is penalized for it.