What is Mean Time to Detect (MTTD) (MTTD)?

What it is

MTTD is a single number: the average gap, in hours or days, between when an attacker first gains a foothold and when the security team discovers the intrusion. It is calculated by summing the detection lag across a set of incidents and dividing by the number of incidents.

A lower MTTD means threats are found faster. Industry reports have historically placed average breach dwell times at weeks or months, so even cutting MTTD from 30 days to 10 days meaningfully reduces attacker opportunity.

MTTD is one of a pair of metrics. The companion metric is Mean Time to Respond (MTTR), which measures how long remediation takes after detection. Together they describe the full detection-and-response cycle.

Why it matters

Every hour an attacker goes undetected is time to move laterally, exfiltrate data, or plant persistence mechanisms. A high MTTD directly increases the blast radius of a breach. Boards and regulators increasingly ask for this number because it is concrete and comparable across quarters and peer organizations.

Security teams track MTTD to justify investment in detection tooling, to set SLAs with managed service providers, and to measure whether process changes are working.

How tools address it

No single product is labeled "an MTTD tool," but several categories directly affect the metric:

• Managed Detection and Response (MDR) services provide 24/7 analyst coverage and pre-built detection logic, which reduces the time alerts sit unreviewed. Platforms like those in the MDR category often publish MTTD commitments in their SLAs.
• SIEM and XDR platforms correlate logs and endpoint telemetry to surface threats that would otherwise hide in noise.
• AI Threat Detection tools apply machine learning to flag anomalies faster than rule-based systems alone.