What is MTTR (Mean Time to Respond)?

MTTR starts the clock at detection, not at incident inception, which is what separates it from MTTD. The clock stops when the analyst has taken a response action that measurably changes the trajectory of the incident: isolating an endpoint, blocking an IP or domain at the firewall, disabling a compromised account, killing a malicious process, or handing the case to incident response with containment already applied. A false-positive closure also stops the clock, since ruling out a threat is itself a completed response.

Consider a concrete case: a SIEM correlation rule fires at 14:02 on a host beaconing to a newly registered domain. The analyst opens the alert at 14:05 (queue time, not counted in MTTR), pulls the EDR process tree and confirms a PowerShell child process spawned from a Word document, checks the destination IP against threat intel and finds it flagged as C2 infrastructure, and isolates the host via EDR at 14:14. MTTR for this alert is 12 minutes, the window during which the attacker retained an active foothold after the SOC knew something was wrong.

MTTR is composed of sub-phases an analyst can individually optimize: alert assignment latency (how long an alert sits in the queue before someone picks it up), investigation time (pulling logs and pivoting across SIEM, XDR, and firewall data to correlate identity and network evidence), decision time (is this a true positive, and what response is proportionate), and execution time (actually issuing the isolation or block command, which can be slowed by change-control processes or clunky tooling). SOAR platforms compress MTTR mainly by automating the investigation and execution phases: a playbook can auto-enrich an IP against threat intel feeds, auto-pull related events, and even auto-isolate a host for a defined alert category, leaving the analyst to validate rather than manually assemble evidence.

MTTR should be read alongside severity and alert type, not as a single blended number. A blended average across critical ransomware alerts and routine port-scan alerts hides the fact that critical incidents may already meet a tight target while a category of ambiguous alerts drags the average up. Segmenting MTTR by alert type reveals where playbooks are missing or where investigation steps are still manual and repetitive, both prime candidates for automation.