Mean Time to Detect (MTTD)

MTTD is calculated by summing the total detection time for all incidents over a specific period and dividing by the number of incidents. Detection time is the delta between the Time of Compromise and the Time of Discovery. This metric measures the effectiveness of monitoring controls, not the response. It is a critical input for assessing the performance of a Security Operations Center (SOC).

While often used interchangeably, a technical distinction exists. MTTD measures the time to any initial alert or indication of malicious activity. Mean Time to Identify (MTTI) measures the time to triage that alert, confirm it is a true positive, and fully understand the scope of the incident. MTTI is a subset of the total detection lifecycle, focusing on analyst validation rather than raw tool alerting.

Several architectural and procedural elements directly impact MTTD:

• Log Coverage: Gaps in endpoint, network, or cloud log ingestion create blind spots.
• Detection Engineering: The quality of SIEM rules and behavioral analytics determines alert fidelity.
• Noise Ratio: A high volume of false positives causes alert fatigue, burying real incidents.
• Tool Integration: Siloed point solutions without a centralized data lake delay correlation.

Signature-based detection fails against novel attacks. User and Entity Behavior Analytics (UEBA) and Network Traffic Analysis (NTA) establish a behavioral baseline of normal activity. Deviations from this baseline—such as a service account accessing a SCADA engineering workstation for the first time—generate high-fidelity anomalies, slashing detection time for zero-day threats and insider attacks.

In Operational Technology (OT) networks, MTTD is often dangerously high due to legacy protocols like Modbus and DNP3 that lack native security logging. Detection requires passive monitoring via Network TAPs and protocol-aware deep packet inspection. A successful process-aware detection strategy correlates network anomalies with physical process state changes to identify cyber-physical attacks that traditional IT tools miss.

The SANS Institute and Verizon DBIR provide annual benchmarks. Global median MTTD often hovers around 200+ days for internally detected breaches, though organizations with mature threat hunting programs and Extended Detection and Response (XDR) platforms aim to reduce this to hours or minutes. The 1-10-60 rule sets an aspirational goal: 1 minute to detect, 10 minutes to triage, and 60 minutes to contain.

The sister metric to MTTD, Mean Time to Respond (MTTR) measures the average time taken to neutralize a threat after it has been detected. While MTTD focuses on visibility speed, MTTR focuses on remediation velocity. The sum of MTTD and MTTR defines the total dwell time of an attacker.

• Goal: Minimize the gap between detection and containment.
• OT Context: Response in an ICS environment is complex, often requiring safety-validated patches or physical disconnection rather than automated scripts.

Dwell time is the total duration an adversary remains undetected within a network, calculated as MTTD + MTTR. It represents the window of opportunity for data exfiltration or destructive payload delivery.

• Critical Insight: A low MTTD is meaningless if MTTR is high; the attacker is still active.
• ICS Reality: The median dwell time in industrial environments is often higher than in IT due to legacy visibility gaps.

A detection methodology that correlates network anomalies with the physical state of the industrial process. Instead of just flagging a suspicious Modbus write, it checks if the command is physically dangerous given the current tank level or valve position.

• Reduces False Positives: Distinguishes a malicious command from a benign engineering change.
• Impact on MTTD: Lowers detection time by prioritizing high-fidelity, context-rich alerts over generic network noise.

A statistical model of normal network traffic and device communication patterns established over a learning period. Anomaly detection systems compare real-time traffic against this baseline to flag deviations.

• Drift Sensitivity: Baselines must be continuously updated to avoid alert fatigue caused by concept drift.
• MTTD Factor: A tight, accurate baseline is the single biggest factor in reducing detection time for zero-day threats.

A proactive, hypothesis-driven search through networks and endpoints to identify threats that have evaded automated defenses. Unlike passive alerting, threat hunting actively seeks out indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).

• Proactive MTTD: Hunting reduces MTTD by finding silent failures in automated detection logic.
• ICS Focus: Hunters in OT environments often look for subtle engineering workstation anomalies rather than malware signatures.

The Cumulative Sum (CUSUM) algorithm is a sequential analysis technique used for changepoint detection. It accumulates deviations from a target mean, triggering an alert when the cumulative sum exceeds a defined threshold.

• Sensitivity: Highly effective at detecting small, persistent shifts in sensor data that indicate a stealthy attack.
• MTTD Application: CUSUM is often deployed to monitor process values (e.g., pressure, voltage) for early signs of manipulation that signature-based tools miss.