What Is Mean Time to Detect?

Mean time to detect measures how long it takes to become aware that something is wrong. It is the headline security operations metric and among the easiest to report misleadingly.

The difficulty is the start point. Detection time is measured from when the activity began, and when it began is only known after an investigation — which means the honest version of this metric cannot be computed in real time.

The two things people mean by it

Alert to acknowledgement — how long between the system raising something and an analyst opening it. Easy to measure, genuinely useful for staffing decisions, and not detection time.

Compromise to awareness — how long the adversary was present before anyone knew. Hard to measure, requires forensic reconstruction, and the only version that describes security outcomes. Reporting the first while implying the second is the most common distortion in operations reporting.

Why the average is the wrong statistic

Detection times are heavily skewed. Automated detections resolve in minutes; the intrusion nobody noticed ran for eight months. An average across those describes neither.

Medians, percentiles and distributions are more honest. So is segmenting: detection time for commodity malware and for a quiet credential-based intrusion are different problems with different answers, and averaging them hides both.

Perverse incentives it creates

A team measured on this metric can improve it by detecting easy things faster, by counting only the incidents it detected itself, or by classifying ambiguous events as non-incidents. All three improve the number without improving security.

The counterweight is the proportion of incidents discovered internally rather than reported by a customer, a partner, law enforcement or a ransom note. That number resists gaming.

What actually reduces it

Telemetry coverage, because you cannot detect activity on systems you do not observe. Detection content matched to techniques rather than to indicators. Alert quality, because an analyst buried in false positives detects nothing quickly.

And staffed hours, which is frequently the dominant factor: an intrusion beginning at nine on Friday evening in an organisation monitoring weekdays only has a structural floor of around sixty hours.

Report it with its context

A single figure invites comparison with industry benchmarks measured differently against different estates. Reporting it alongside what is monitored, what hours are staffed and how incidents were discovered turns a number into something a board can act on.

Benchmarks deserve scepticism

Published industry figures are compiled from incidents that were eventually discovered, measured by organisations using different definitions across different estates. They are useful for direction of travel and close to meaningless as a target.

Your own trend over time, against a consistent definition, is the more informative comparison — and a figure that improves while the proportion of incidents discovered internally falls is not an improvement at all.

Where to start

Define which of the two measurements you are reporting and say so explicitly in the reporting. Ambiguity here is the source of most misplaced confidence about detection capability.

See metrics that improve outcomes and time to respond. GuardsArm delivers SOC as a service.