Safeguard
Security Guides•

On-call health metrics for a security team's quarterly review

Six simple measures of pager health for a security team, from pages per shift to toil share, plus thresholds borrowed from Google's SRE guidance.

Safeguard Security Team
3 min read

Track a handful of numbers each quarter: pages per shift, night pages, share of pages that were actionable, toil share, spread of load across people, and follow-up completion. Compare them with simple thresholds such as two incidents per shift, and use the trend to decide what to fix next.

The six measures

  1. Pages per shift. The SRE book treats a maximum of two incidents per 12-hour shift as the sustainable ceiling, and a median of zero pages per day as ideal.
  2. Night pages. Count pages outside working hours separately. They cost the most.
  3. Actionable share. The book suggests aiming for a 1:1 alert to incident ratio. Track the share of pages that needed action.
  4. Toil share. Google aims to keep toil below 50 percent of engineer time. Estimate yours by sampling a week.
  5. Load spread. Who received the most pages? A fair average can hide one person carrying everything.
  6. Follow-up completion. Share of postmortem action items done by their due date.

How to collect them

Most paging tools can export a list of pages. Add a short weekly survey of how people felt, one to five. Keep it anonymous if the team is small and trust is not yet high.

Reading the numbers

  • Pages per shift rising. Look at the top three sources and apply the retire, tune or automate guide.
  • Night pages concentrated. Rebalance, or reconsider what may page at night.
  • Actionable share low. Alert quality problem.
  • Toil above half. Plan automation work and protect time for it.
  • Follow-ups slipping. Fewer actions, better chosen.

Beware of gaming

Any measure turns into a target. If you celebrate low page counts, people may suppress alerts. Pair pager numbers with spot checks on missed events.

Share them

Show the numbers to the team first, then to management. The book suggests reviewing page frequency regularly, for example in quarterly reports. Use the same meeting to ask for what you need: more staff, time for fixes, or a smaller scope.

What a good review looks like

Keep the quarterly review short: one page of numbers, three observations, and three decisions. Resist the urge to show every chart. A reader who sees a rising night page count and a falling actionable share understands the problem without further explanation.

Record decisions and revisit them the next quarter. If the same problem appears twice, escalate it, since it suggests that the fix needs resources beyond the team. Over time the page becomes a simple history of how the rotation improved.

Quick check

Is a lower page count always better?

Mostly, but not at any cost. The book also warns that too little exposure leaves gaps in skill and confidence.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.