DefinitionMTTD (Mean Time to Detect) is the average time between the start of malicious activity and its detection. MTTR (Mean Time to Respond) is the average time between detection and containment or resolution. Together, they measure how long an attacker operates in the environment.
How they work
The two metrics split an incident timeline into stages:
- MTTD: from the first sign of malicious activity to the moment it is identified as an incident. It reflects the quality of telemetry, detection rules and 24×7 monitoring.
- MTTR: from detection to containment or resolution. It reflects processes, playbooks, automation and the authority to act.
Combined, they show the exposure window: the time the adversary had to move, escalate privileges and extract data.
Measuring with care
The "R" in MTTR means different things depending on the source: respond, recover, remediate or resolve. Before comparing figures from different vendors or periods, confirm where each count starts and ends. The same applies to MTTD: the real start of an attack is often known only after the investigation.
Averages also hide extremes. A serious incident that took weeks to detect can disappear among hundreds of alerts resolved in minutes. It is worth tracking the median and the worst cases, broken down by severity.
MTTD and MTTR vs RTO and RPO
MTTD and MTTR measure the actual performance of security operations when facing incidents. RTO and RPO are business continuity targets: how long a system can be down and how much data loss is acceptable. A low MTTR helps meet the RTO, but the metrics answer different questions.
Network Secure operates a 24×7 SOC certified to ISO/IEC 27001:2022.
Frequently asked questions
What does the R in MTTR stand for?
It depends on the context. In security operations it usually means Mean Time to Respond, but it also appears as recover, remediate or resolve. What matters is that the contract or report defines where the count starts and ends.
What is the difference between MTTR and RTO?
MTTR measures the average time the team actually took to respond to incidents. RTO is the business-defined target for how long a system may be unavailable.