Cybersecurity glossary
What is Mean Time to Detect (MTTD)?
Learn what Mean Time to Detect (MTTD) is, how to measure the gap between compromise and discovery, which clock-start mistakes distort the metric, and how to actually shrink dwell time.
Definition
Mean Time to Detect (MTTD) is the average time between when a security incident begins—typically initial compromise or first malicious action—and when the organization first becomes aware of it through monitoring, hunting, or external notice.
Why the most expensive minutes are the ones before anyone looks
Prevention fails quietly. The damage often happens in the dark: token theft on Friday, data staging over the weekend, encryption on Monday. Mean Time to Detect (MTTD) measures that darkness—the average delay from the start of an incident to first awareness.
If you only count the cases you already caught, you are grading your luck, not your detection program.
What the metric is supposed to capture
Clock start
Earliest reliable evidence of the intrusion or abuse, even if you only learned that timestamp during forensics.
Clock stop
First moment the organization treats it as a security incident—SOC case, hunter note, or credible external notice.
Population
All qualifying incidents in the period, including those found by customers or law enforcement, not only SIEM-sourced wins.
Segmentation
Separate identity, ransomware, and app abuse. One blended average is a board slide, not a diagnostic.
How MTTD actually shrinks
See the first action
Identity, email, and EDR telemetry with retention that still exists when you investigate weeks later.
Detect the technique
TTP content and canaries beat hoping the same hash appears again.
Notice the alert
On-call, clustering, and low fatigue so the first true positive is not item 400 in the queue.
Hunt what rules miss
Hypothesis searches for dwell that never paged—then promote those hunts into detections.
Include the ugly cases
External notification still counts. Hiding those incidents makes MTTD look healthier as you get worse.
Measurement traps
| Trap | How it distorts | Honest alternative |
|---|---|---|
| Start at alert time | Ignores pre-alert dwell entirely | Start at first malicious evidence |
| Stop at log ingest | Counts unseen events as “detected” | Stop at human or playbook recognition |
| Only SOC-found cases | Drops the long-dwell breaches | Include customer and public discoveries |
| One global mean | Phish-in-minutes hides stealthy persistence | MTTD by incident class |
- Write clock-start and clock-stop definitions in the IR standard; do not improvise per case.
- Record both alert-created time and forensic initial-access time on every incident.
- Break MTTD down by identity, endpoint, cloud, and email-originated incidents.
- Count queue delay: an alert that sat 18 hours is not an 18-second detection.
- Review incidents found outside the SOC as first-class MTTD failures.
- Pair MTTD with coverage maps; a great average on three noisy rules is not a program.
- Do not incentive “close fast” in a way that reclassifies true incidents as noise.
- Recompute after major telemetry changes; new logs can retroactively shorten apparent dwell.
The practical takeaway
MTTD is the average time attackers operate before you know they are there. Start the clock at real initial activity, stop it at genuine awareness, segment by incident type, and spend effort on telemetry and detections—not on a prettier mean.
Related security terms
Mean Time to Respond (MTTR)
The companion metric for action after detection.
Detection Engineering
The work that most directly changes MTTD for known techniques.
Anomaly Detection
Can catch unknown procedures that signature MTTD would miss.
Alert Fatigue
Hides true positives in the queue, inflating effective MTTD.
Security Operations Center (SOC)
Where detection clocks often stop—or should.
Frequently asked questions
What is MTTD in simple terms?
It is how long, on average, attackers are in your environment before anyone notices—measured from the start of the incident to first awareness.
Is MTTD the same as dwell time?
Dwell time often means the full period until eviction. MTTD stops at detection. You can detect quickly and still dwell if response is slow (see MTTR).
When does the MTTD clock start?
Best practice is first evidence of unauthorized activity (initial access), not when the SIEM first stored a log. If you cannot see start time, say so—do not fake precision.
When does it stop?
When a human or an automated process first recognizes the incident as security-relevant, not when a noisy informational event happened to exist.
Why is a very low MTTD sometimes a lie?
Teams start the clock at alert creation, which ignores weeks of undetected access, or they only measure incidents the SOC already caught—selection bias.
How do you improve MTTD?
Better telemetry, TTP detections, hunting, canaries, and reducing queue delay so the first true alert is actually seen.
Should MTTD be one company-wide number?
Prefer breaking it out by incident class (ransomware precursor, BEC, insider). Averages hide that identity attacks are found in hours while stealthy persistence lasts months.
References
Explore authoritative guidance and frameworks related to mean time to detect (mttd).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.