Which metric measures the time from incident onset to detection?

• A. Mean Time To Respond (MTTR)
• B. Incident Counts
• C. Mean Time To Detect (MTTD)
• D. Time To Recover

Answer: (C)

Detection latency—the time from when an incident begins to when it’s discovered—is what this metric captures. Mean Time To Detect measures that latency across incidents, giving the average time it takes to notice problems. This matters because the longer an incident goes undetected, the more opportunity there is for it to cause damage, so reducing MTTD helps limit dwell time and risk. For example, if an incident starts at 2:00 and is detected at 2:05, the MTTD is about five minutes on average for that event.

Other metrics focus on different phases: mean time to respond looks at how quickly you act after detection, time to recover measures how long it takes to restore services after containment, and incident counts track how many incidents occur rather than how long detection takes.