Outcome
Did risk go down. These are the ones to report upward, and the ones that are hardest to move.
Mean time to detectMTTD
How long is an intruder in the estate before anybody knows?
sum(detection time − earliest evidence time) ÷ incidents
where the clock startsThe EARLIEST evidence in your logs, not the moment an alert fired. This is the definition that matters and the one most tools get wrong: measuring from the alert measures your ticketing system, not your detection.
what good looks likeUnder 24 hours is a reasonable target for most organisations; regulated and high-risk sectors work toward under an hour. For context on how far that is from typical, Mandiant put global median dwell time at 14 days in its most recent M-Trends, up from 11.
how it gets gamedStart the clock at the alert rather than at first evidence and MTTD collapses to minutes without a single detection improving. If the number falls sharply and nothing about the estate changed, check the definition before celebrating.
alsoReport the median alongside the mean. One four-month intrusion drags a mean into uselessness, and the median is what describes a normal week.
Mean time to respondMTTR
Once we know, how long until it stops?
sum(containment time − detection time) ÷ incidents
where the clock startsConfirmed detection to containment. Decide whether you mean containment or full remediation and then never change it: they differ by days, and a chart that silently switches definitions is worse than no chart.
what good looks likeDepends entirely on containment authority. A team that can isolate a host without waiting for approval measures in minutes; one that raises a change request measures in days. If yours is slow, the constraint is usually authority rather than skill.
how it gets gamedClose the ticket at containment and log remediation separately, and MTTR looks excellent while machines stay compromised. Reporting both, with the gap between them, is the honest version.
Dwell time
How long did they have, in total?
eviction time − initial compromise time
where the clock startsInitial compromise, established in the investigation, to full eviction. It spans MTTD and MTTR and is the number a board understands without translation.
what good looks likeGlobal median around 14 days per M-Trends. Ransomware skews far lower because the attacker announces themselves; espionage skews far higher.
how it gets gamedOnly the incidents you found have a dwell time at all. A falling median can mean you are catching the fast ones and missing the patient ones, which is the worse position.
Time to containment authority
How long between wanting to isolate a host and being allowed to?
approval granted time − containment proposed time
what good looks likeRarely measured and often the largest single component of MTTR. Measuring it separately turns "the SOC is slow" into "the SOC waited six hours for a decision", which is a different conversation and a fixable one.
how it gets gamedNone worth naming. The risk here is not gaming, it is that nobody measures it at all, so the delay stays attributed to the team that was waiting.
