What Is Mean Time to Respond?

Mean time to respond measures how long it takes to act once something has been detected. It is the companion to time to detect, and it is the half an organisation has most direct control over.

It also hides more ambiguity, because respond can mean anything from opening a ticket to fully remediating the root cause.

Define which milestone you mean

Acknowledged — a human is looking at it. Contained — the activity can no longer spread or cause further harm. Eradicated — the adversary's access is removed. Recovered — affected systems are back in normal service.

Containment is the milestone that matters most, because it is where harm stops accumulating. Measuring to acknowledgement produces flattering numbers that say little about outcomes.

What dominates the number

Rarely the technical work. Usually the decision: whether to isolate a machine that someone is working on, whether to disable an executive's account, whether to take a production system offline.

Where those decisions need escalation to someone unavailable at two in the morning, response time is set by the escalation chain rather than by the responders. Pre-authorising containment actions, in writing, for defined circumstances is usually the single largest improvement available.

Automation helps at the edges

Isolating an endpoint, disabling an account or blocking a destination can be automated and executed in seconds. That is genuine improvement for high-confidence detections.

It is also where a false positive becomes an outage, which is why the durable pattern is automation that prepares the action and a human who approves it. See SOAR for where that line usually sits.

Practice moves it more than tooling

Teams that have rehearsed a scenario respond faster to it, reliably and measurably. A tabletop exercise surfaces the questions that otherwise get asked for the first time during a real incident: who calls whom, who can authorise this, where is the contact list when email is down.

The recurring discovery is that the plan assumes people and systems that are unavailable at the moment it would be needed.

Segment before averaging

Response to a contained commodity malware detection and response to a suspected ransomware deployment are different problems. Averaging them produces a figure that describes neither and that moves mostly with the mix of incident types.

The regulatory clock runs separately

Many privacy and sector regulations impose notification deadlines measured from awareness of a breach, frequently seventy-two hours. That clock is independent of technical response and it starts earlier than most teams assume.

The implication is that legal and communications work has to run in parallel with containment rather than after it, and that the point at which the organisation is considered aware needs a defined answer. Deciding that during an incident, while also trying to contain it, is how notification deadlines get missed.

Where to start

Establish who can authorise isolating a production system at three in the morning without waking anyone else. If the answer is unclear, that ambiguity is your response time.

See your plan will fail on a Saturday morning and tabletop exercises. GuardsArm delivers incident response.