Cybersecurity glossary
What is Mean Time to Respond (MTTR)?
Learn what Mean Time to Respond (MTTR) is in cybersecurity, how it differs from MTTD and IT reliability MTTR, which clocks to use, and how playbooks and authority actually shorten response.
Definition
Mean Time to Respond (MTTR) is the average time from when a security incident is detected—or from an agreed response-start event—until containment or another defined response outcome is achieved, measuring how quickly the organization acts once it knows something is wrong.
Why knowing is not stopping
A perfect detection that sits in a queue does not isolate a host. Mean Time to Respond (MTTR) asks how long action takes after awareness: revoke the session, contain the endpoint, kill the OAuth app, sinkhole the C2.
It is a speed metric with a quality constraint. Fast wrong containment is just a second incident.
Define the clocks before you brag
Response start
Usually first confirmed detection or case open—not when someone later names the malware family.
Containment stop
Spread is interrupted: isolation, token revoke, disable, or block that matches the incident type.
Eradication / recover stop
Optional second metric. Persistence gone and service restored are different finishes than first contain.
Class split
BEC, ransomware, and insider cases have different mechanical steps; one mean hides the slow class.
What actually shortens response
Pre-authorize the moves
SOC and IR already know who can isolate, disable, and talk to customers—without a new meeting.
Rehearse the buttons
EDR isolate, IdP session revoke, and DNS sinkhole are tested in drills, including failback.
Put evidence next to the action
Playbooks show the process tree or login, not a generic “contain threat” sentence.
Automate the boring minutes
Enrichment and low-regret blocks via SOAR; humans keep high-blast-radius decisions.
Remove approval theater
After-hours delays are usually missing authority, not missing tools.
MTTD, MTTR, and neighboring times
| Metric | Asks | Common cheat |
|---|---|---|
| MTTD | How long until we know? | Start the clock at the alert, ignoring earlier access |
| MTTR (contain) | How long until we stop the bleeding? | Stop the clock when a ticket is assigned, not when isolate succeeds |
| Time to eradicate | How long until persistence is gone? | Declare clean before hunting sibling hosts |
| Time to recover | How long until the business is back? | Confuse “VPN up” with “attacker keys revoked” |
- Publish separate definitions for time-to-contain, time-to-eradicate, and time-to-recover.
- Log the timestamp of the actual control action (API isolate), not only the case comment.
- Include waiting-on-approval time; hiding it makes MTTR look like a tooling problem.
- Drill after-hours containment for identity and endpoint, not only tabletop slides.
- Do not reward the fastest close if reopen or reinfection rates climb.
- Give the SOC least-privilege rights that are still sufficient to act.
- Review a sample of “contained” cases for leftover tokens and scheduled tasks.
- Report MTTR beside MTTD so leaders see both darkness and hesitation.
The practical takeaway
MTTR is how quickly you act after you know. Define containment as a real control firing, rehearse who is allowed to fire it, and keep MTTD on a separate clock—so a fast ticket is never mistaken for a stopped attacker.
Related security terms
Mean Time to Detect (MTTD)
Measures awareness delay; MTTR measures action after awareness.
Incident Response
The process whose speed MTTR tries to quantify.
Security Orchestration, Automation and Response (SOAR)
Can shorten MTTR for pre-approved, low-regret actions.
Security Operations Center (SOC)
Often owns the first response minutes that dominate MTTR.
Forensic Analysis
Must not silently pause containment while every curiosity is imaged.
Frequently asked questions
What is MTTR in simple terms?
Once you know there is an incident, how long on average until you actually contain it—or reach another outcome you defined, such as eradicating persistence or restoring service.
Is security MTTR the same as ITIL mean time to repair?
Same acronym, different job. Reliability MTTR is about restoring a broken service. Security MTTR is about acting on an intrusion. Do not mix the two dashboards.
Does MTTR start at detection or at incident declaration?
Pick one and write it down. Detection-to-contain is common. Starting only after a formal IR bridge can hide hours of SOC delay.
What should the clock stop on?
A defined outcome: network isolation complete, tokens revoked, or attacker-controlled accounts disabled. “Ticket closed” is not containment.
Can automation make MTTR worse?
Yes if playbooks wait on broken APIs, or if humans pause because they do not trust auto-isolate. Measure failed automations as delays, not as speed.
How is MTTR different from MTTD?
MTTD is time-to-know. MTTR is time-to-act. A team can detect in minutes and still take days to revoke a cloud key.
Should we optimize MTTR to zero?
Not if that means skipping evidence or isolating the wrong hospital system. Pair speed with a minimum quality bar and dual-control on destructive actions.
References
Explore authoritative guidance and frameworks related to mean time to respond (mttr).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.