MTTI (Mean Time to Investigate)

MTTI measures the efficiency of the investigation process itself, from the moment an analyst begins examining an alert to the point where a verdict is reached and appropriate action is determined. Long MTTI is often caused by manual enrichment steps, tool fragmentation, and inconsistent analyst skill levels. Reducing MTTI is one of the highest-impact improvements a SOC can make, as faster investigations directly reduce the time attackers have to act.