Mean time to detect (MTTD)

Mean time to detect (MTTD) is the average time between when an incident, security or operational, actually begins and when a team becomes aware of it, typically measured from event timestamps in a SIEM or monitoring system to the timestamp an alert was acknowledged. It is calculated as the total detection time across incidents divided by the number of incidents.

MTTD differs from mean time to resolve, which measures the time from detection to fix; the two together describe the full incident timeline, and a short MTTD with a long resolution time points to a triage and remediation problem, while a long MTTD points to gaps in monitoring coverage or alert tuning. It is closely related to but distinct from mean time between failures, which describes how often incidents happen rather than how fast they are noticed.

MTTD matters in both a security operations center, where it measures how long an attacker had undetected access, and in IT operations, where it is a core reliability input. A common pitfall is comparing MTTD across teams without normalizing for incident severity, since a handful of slow, complex detections can skew the average far more than the underlying detection capability suggests.