Mean Time to Detect

Definitions

1. A security operations metric measuring the average time between the start of malicious activity and when defenders detect it. Mean time to detect helps quantify visibility and alerting effectiveness, though it can be distorted by incidents that begin long before discovery.

   In plain English: The average time it takes to notice an attack or incident.

   Example: "The postmortem showed their mean time to detect was still too high for identity-based attacks that left few endpoint traces."

Related Terms

• Incident Response
• Dwell Time
• Alert Fatigue
• Automated Threat Detection
• Canary
• Continuous Monitoring
• Detection Rule
• Hygiene Score
• Managed Detection and Response
• MDR
• MSSP
• Risk Quantification
• Runtime Protection