Mean Time to Detect (MTTD)
Average time from a security incident occurring to its detection
What is Mean Time to Detect (MTTD)?
Mean time to detect is the average time between a security incident occurring and it being detected. It shows how quickly an organisation notices when something has gone wrong.
The longer an attacker remains undetected, the more damage they can do, so faster detection is a key security goal.
How this KPI is measured
- Function
- Information Technology
- Sub-function
- Cyber Security
- Industry
- All Industries
- Type
- Lagging
- Impact
- Risk
- Unit
- hrs
- Measurement frequency
- Monthly
- Formula
- Sum of time from incident occurrence to detection / Number of security incidents
How to calculate it
Add up the time from incident occurrence to detection and divide by the number of security incidents.
For example, if 10 incidents took a combined 480 hours to be detected, MTTD is 48 hours.
The start time often has to be established during investigation, so record it carefully, and look at the longest cases as well as the average.
Where it is used
Measuring detection capability
See how fast incidents are found.
Improving monitoring
Target blind spots.
Limiting damage
Reduce dwell time.
How to improve it
Tips and common mistakes
- Establishing when an incident began can be hard. Be consistent.
- Look at the longest cases.
- Use with mean time to resolve.
More Information Technology kpi library
Build better plans, faster
Join the waitlist for early access to curated insights, flexible templates, and rapid iteration across strategy, planning, and project management.