What is MTTD and MTTR?
MTTD and MTTR are two core metrics that measure how quickly your security team spots threats and shuts them down. Together, they define the speed of your incident response (IR) cycle.
A low MTTD means your monitoring catches intrusions early, and a low MTTR means your team resolves them before attackers can move laterally or exfiltrate data.
In practice, these two numbers tell you more about your security posture than almost any other KPI. They expose gaps in detection coverage, weaknesses in IR playbooks, and bottlenecks in tooling and team coordination.
Mean time to detect (MTTD)
MTTD is the average time between when a security incident begins and when your team discovers it. This metric measures the effectiveness of your monitoring, alerting, and threat detection capabilities.
A high MTTD usually points to blind spots, like workloads without runtime monitoring, cloud APIs that are not sending logs to your SIEM, or detection rules that have not been tuned to your environment.
Log collection, alert correlation, and analyst triage all contribute to detection time. Incidents are also more difficult to detect in the cloud due to limited visibility across distributed services and locations and their rapidly changing nature.
Mean time to respond (MTTR)
MTTR is the average interval between detecting an incident and fully remediating it. It captures everything from initial triage and investigation to containment, eradication, and recovery. The acronym is sometimes expanded as mean time to repair, resolve, or recover. This article uses 'respond' to cover the full scope from initial triage through remediation.
MTTR is different from mean time to failure (MTTF), which measures the expected lifespan of an irreparable system component. Unlike MTTF, MTTR assumes the affected system is repairable and focuses on how efficiently your incident response team moves through each stage of the response process.
MTTD vs. MTTR: key differences
While MTTD and MTTR are often discussed together, they measure different phases of the incident lifecycle and require different strategies to improve. The table below breaks down how they compare.
| Metric | Full name | What it measures | Who owns it | How to improve it | New Column 3 |
|---|---|---|---|---|---|
| MTTD | Mean time to detect | Time from incident start to discovery | SOC / detection engineering | Expand detection coverage, tune alerting, establish behavioral baselines | Minutes to hours |
| MTTR | Mean time to respond | Time from detection to full remediation | IR team / SecOps | Automate triage, strengthen IR playbooks, use unified tooling | Hours to days (depending on severity) |
The critical insight is that improving one metric without the other does not solve the problem. Detecting a breach in seconds is meaningless if your response takes weeks. Similarly, a rapid response process cannot compensate for months of undetected attacker activity.
In practice, most teams find that MTTD improvements come from tooling and detection engineering investments, while MTTR improvements require process maturity and cross-team coordination. Tracking both metrics together reveals whether your security program is balanced or over-indexed on one side of the lifecycle.
How to calculate MTTD and MTTR
Calculating MTTD and MTTR requires tracking timestamps for every incident across a defined period, typically a quarter or a year. The formulas are straightforward, but the real value comes from measuring them consistently to ensure you’re accurately comparing performance over time. That’s what helps you identify real trends and drive improvements.
MTTD formula and example
To calculate MTTD, add the total detection time across all incidents in a given period and divide by the number of incidents.
MTTD = total time to detect incidents / number of incidents
For example, suppose your SOC detected four incidents last quarter with detection times of 2, 8, 1, and 5 hours. MTTD = (2 + 8 + 1 + 5) / 4 = 4 hours. That number becomes your baseline. If one incident with a 24-hour detection time appears the following quarter, it will pull the average up significantly, highlighting a gap worth investigating.
MTTR formula and example
To calculate MTTR, add the total resolution time for all incidents (from detection through remediation, including any downtime) and divide by the number of resolved incidents.
MTTR = total time to resolve incidents / number of resolved incidents
Imagine your team resolved three incidents with resolution times of 6, 12, and 3 hours. MTTR = (6 + 12 + 3) / 3 = 7 hours. If you then break that down by severity, you might find that your Sev-1 MTTR is 12 hours while Sev-3 is under 2 hours. That granularity reveals where your IR process needs the most attention.
Why MTTD and MTTR matter in cybersecurity
MTTD and MTTR matter because the speed at which your team can find and fix security threats directly affects how much damage an incident can cause. Faster detection and response reduce downtime, limit data loss, and lower overall risk.
Attacker dwell time is increasing
The longer an attacker dwells in your environment, the more damage they can inflict. Mandiant's M-Trends 2026 report found that the global median dwell time rose by three days in the past year—from 11 days to 14 days—meaning most organizations give attackers two full weeks before detection.
This could be due in part to AI expanding the attack surface with more systems, entry points, and interactions to monitor, making threats harder to detect. AI also enables attackers to generate more sophisticated and higher-volume attacks, making it easier for malicious activity to blend in with normal behavior.
To understand the importance of a low MTTD, consider the Microsoft Midnight Blizzard attack, which began in November 2023 and was not discovered until January 12, 2024. The MTTD was roughly two months, during which attackers moved laterally and exfiltrated secrets from corporate email systems. While Microsoft has since taken steps to resolve the incident, the damage could have been far more limited with earlier detection.
Financial losses are substantial
IBM's 2025 Cost of a Data Breach Report adds a financial dimension. Organizations that deployed AI and automation across their security workflows cut their breach lifecycle by 80 days and saved an average of $1.9 million per breach compared to companies that didn’t use these solutions. That is a direct financial argument for investing in the tools and processes that drive MTTD and MTTR down.
Regulatory pressure is rising
The SEC now requires publicly traded companies to disclose material cybersecurity incidents within four business days. A high MTTD can increase breach costs and compresses the time your legal, communications, and IR teams have to respond once a breach is finally discovered.
MTTD and MTTR reveal security investment value
Beyond compliance, MTTD and MTTR serve as evidence of how effective your security investments are.
Wiz research shows that 80% of cloud intrusions in 2025 began with vulnerabilities, secrets, or misconfigurations, reinforcing why continuous detection coverage is essential. When attacks are detected and remediated quickly, your organization experiences more uptime, a stronger security posture, and better customer trust.
How to reduce MTTD and MTTR
Reducing these metrics requires targeted improvements at each stage of the incident lifecycle. The strategies for lowering detection time differ from those that speed up response, so it helps to address them separately.
Strategies to lower MTTD
Detection speed depends on how well your monitoring covers your environment and how quickly anomalies surface above the noise, making broad detection coverage across every phase of the attack lifecycle essential.
Automated threat detection: Implement automated detection tools that continuously monitor systems and flag suspicious activity in real time. This reduces reliance on manual review and helps you identify threats faster and more consistently.
Behavioral analytics: Use behavioral analytics to establish baselines of normal user and system activity, then detect anomalies that may indicate a threat. This way, you can uncover subtle or previously unknown attack patterns that traditional rules might miss.
Expanded cloud asset visibility: Maintain a complete, up-to-date inventory of cloud assets and ensure all systems are properly monitored. Greater visibility reduces blind spots and enables security teams to detect incidents across distributed environments more quickly.
Threat intelligence integration: Incorporate external threat intelligence feeds to stay informed about emerging threats and known attack indicators. This enables faster recognition of malicious activity and improves the accuracy of detection efforts.
Strategies to lower MTTR
Response speed comes down to preparation, clarity of process, and the ability to act without switching between disconnected tools.
Automated response playbooks: Use automated incident response playbooks to trigger predefined actions as soon as a threat is confirmed. This reduces manual delays and ensures incidents are handled quickly and consistently.
Pre-built remediation actions: Develop and maintain pre-built remediation actions for common incident types. This allows you to resolve issues faster without needing to start from scratch during high-pressure situations.
CDR platforms: Use Cloud Detection and Response (CDR) platforms to centralize incident data and accelerate response workflows across cloud environments. These platforms help you investigate, contain, and remediate threats more efficiently.
Cross-team coordination tools: Adopt tools that improve communication and coordination between security, IT, and operations teams. Faster alignment between teams reduces bottlenecks and speeds up overall incident response time.
How MTTD and MTTR fit with other incident response metrics
MTTD and MTTR don’t exist in isolation. Several related metrics cover different phases of the incident lifecycle, and tracking them together gives your team a more complete picture of operational readiness.
| Metric | Full name | What it measures | Where it fits in the IR lifecycle |
|---|---|---|---|
| MTTA | Mean time to acknowledge | Time from alert to first human action | Triage phase |
| MTTC | Mean time to contain | Time from detection to isolation of affected components | Containment phase |
| MTBF | Mean time between failures | Duration of stable operation between incidents | Reliability/availability |
| MTTF | Mean time to failure | Expected time before an irreparable component fails | Lifecycle planning |
The relationship between these metrics matters. A low MTTA but high MTTR, for instance, tells you that your team acknowledges alerts quickly but struggles with investigation or containment. Tracking each metric separately helps you pinpoint exactly where the IR process breaks down.
Organizations that adopt digital forensics and incident response (DFIR) practices can systematically reduce dwell time and accelerate root cause analysis.
How Wiz helps improve MTTD and MTTR in the cloud
Improving MTTD and MTTR in cloud environments requires detection and response tooling purpose-built for cloud architecture, not legacy SIEM or EDR tools adapted from on-premises environments. Wiz addresses this directly.
Wiz CDR detects misconfigurations and software vulnerabilities and simulates possible attack paths before they are exploited.
The Wiz Runtime Sensor provides real-time visibility into your entire workload, including apps, running processes, databases, containers, hosts, APIs, and serverless environments, then presents all scan results in a unified monitoring dashboard.
Using intelligence from anomaly detection and CNAPP context, Wiz assigns criticality to threats to help your teams eliminate noise and focus on the most important incidents first.
Wiz AI Agents now compress both MTTD and MTTR by removing the manual bottlenecks that slow each stage:
The Blue Agent automatically investigates every threat the moment it triggers in Wiz Defend, correlating runtime signals, cloud telemetry, and identity context to deliver a clear verdict with full reasoning, often within minutes of detection.
The Green Agent then traces confirmed issues to their root cause, identifies ownership, and generates environment-specific remediation steps, including opening pull requests directly in code.
The Red Agent works continuously, probing web applications and APIs for exploitable logic flaws so your team can fix validated risks before an attacker finds them.
These agents are orchestrated through Wiz Workflows, where teams define how and when AI acts and where human approval is required, enabling automated containment for high-confidence threats while routing lower-confidence findings to the right person for review.
This approach now extends to AI workloads as well. The Wiz AI Application Protection Platform (AI-APP) maps models, agents, tools, and data flows across infrastructure like AWS Bedrock, Azure AI, and Vertex AI, surfacing AI-specific attack paths that traditional monitoring tools miss entirely.
Together, these unified features give security teams the ability to detect threats in seconds, investigate them autonomously, and remediate at the source, driving both MTTD and MTTR down significantly. Customers like Maple saw a 10x improvement in MTTD and MTTR after adopting the platform, while Cribl reduced identification and remediation time from days to minutes.
Get a demo to see how Wiz can accelerate detection and response across your cloud environment.
See Wiz Defend in action
Detect threats in seconds, investigate autonomously, and remediate at the source—all from a unified platform.
