MTTD (Mean Time to Detect)

A low MTTD means threats are identified quickly, limiting the attacker's window of opportunity before they can cause significant damage. MTTD is heavily influenced by the quality of detection coverage, the efficiency of alert monitoring processes, and the volume of false positives that delay analyst attention. Organizations with poor detection coverage or overwhelming alert noise typically suffer from longer MTTDs.