Skip to content

Mean time to detect

Also known as MTTD

The average time between a security event starting and someone noticing it.

It is the honest measure of whether monitoring is working. Tooling that generates alerts nobody triages does not reduce this number, which is why unstaffed SIEM deployments so often fail to change outcomes.

Paired with mean time to respond, it describes your real exposure window. Both are worth tracking over time rather than as a one-off, because they degrade quietly as environments grow.

Where this comes up

Mean time to detect sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Cybersecurity services Ask an engineer

Related terms

Dwell time How long an attacker is inside your environment before they are detected. Security operations centre The team and tooling responsible for monitoring, investigating, and responding to security events. Managed detection and response A service where an outside team watches your security alerts around the clock and responds to real threats on your behalf. Incident response The structured process of detecting, containing, eradicating, and recovering from a security incident.

More in cybersecurity and threats

Application allowlistingAttack surfaceBeaconingBrute force attackBusiness email compromiseCommand and controlContainmentCredential stuffing

Back to the full glossary →

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.