What is MTTD (Mean Time to Detect)?

MTTD starts when the initial compromise or malicious activity actually occurs and ends when the SOC generates an alert or an analyst first identifies the activity. In practice this is measured from a handful of timestamps: the estimated incident-start time, reconstructed from forensic artifacts like file creation times, process start times, or attacker-controlled infrastructure registration dates, the event_time recorded in the log source, and the alert_time when a correlation rule fires or an analyst flags the activity during a hunt. Averaging that gap across all incidents in a measurement period gives the MTTD figure, and it encompasses the full detection pipeline: log ingestion latency, how long between an event occurring and it landing in the SIEM, detection rule evaluation, alert enrichment, and initial triage before the alert is confirmed as a genuine finding.

Industry benchmarks vary dramatically by maturity level. Well-tuned SOCs with strong SIEM and XDR coverage can achieve MTTD under ten minutes for known attack patterns matched by existing rules, while attacks relying on novel techniques or living-off-the-land binaries with no matching signature can go undetected for weeks or months, contributing to the long dwell times reported in industry breach studies. The gap between these outcomes is almost entirely a function of detection coverage, not analyst speed: an attack with no corresponding rule or behavioral baseline simply does not generate an alert, no matter how fast the analysts on shift are.

Factors that reduce MTTD include comprehensive log collection across endpoints, network, and identity, well-tuned correlation rules with low false-positive rates so analysts trust and act on alerts quickly, 24/7 monitoring coverage, active threat hunting that surfaces activity before automated rules catch up, and fast threat intelligence integration that lets new IOCs get matched against historical logs immediately. Factors that increase it include log source gaps, such as an unmonitored server or a cloud service without forwarding configured, alert fatigue from high false-positive rates, limited monitoring hours, and no hunting program to catch what rules miss. MTTD is tracked per incident and per alert type, and a sudden increase after an infrastructure change, a new cloud service, a network re-architecture, a log forwarder outage, is a strong early signal of a coverage gap that needs immediate attention.