Security teams have long optimized mean-time-to-detect. It matters — but detection without containment just tells you how fast you noticed the damage. The number that actually moves the cost of a breach is mean-time-to-respond.
Know your metrics — all of them
“Response” hides several distinct clocks, and improving the wrong one feels like progress while changing nothing:
- MTTD — mean time to detect. From compromise to a detection firing.
- MTTA — mean time to acknowledge. From detection to a human actually picking it up.
- MTTR — mean time to respond/contain. From detection to the threat being stopped.
MTTD gets the attention because it is easy to measure. But an attacker doesn’t stop doing damage the moment you detect them — they stop when you contain them. The window that matters most is the one between detection and containment.
Where cost actually accrues
Industry breach research is consistent on this point: the longer an intrusion stays uncontained, the more it costs. More accounts are compromised, more data leaves, more systems are touched, and remediation grows more expensive by the hour. An intrusion contained in minutes is an incident report. The same intrusion contained in days is a headline, a regulatory filing, and a line item.
The handoff is the bottleneck
In most SOCs, MTTR is dominated not by work but by waiting — the handoffs between detection, triage, approval, and execution. Each step adds queue time: an alert waits to be picked up, an analyst waits for context, a containment action waits for a change ticket or an on-call approval. Queue time is exactly what an attacker exploits. Shaving minutes off detection while leaving a multi-hour response chain intact optimizes the wrong half of the equation.
Automate the response, collapse the window
The way to collapse MTTR is to remove the human waits from the high-confidence path. Autonomous playbooks contain threats the moment they are identified — isolating hosts, revoking sessions, blocking indicators — inside guardrails and with a full audit trail, so speed doesn’t cost you control. MTTR stops being a function of who happens to be awake and becomes a property of the system, consistent at 3 p.m. and 3 a.m.
How to measure it honestly
If you want MTTR to improve, measure it in a way that resists gaming:
- Measure to containment, not to acknowledgment or ticket-closure.
- Segment by severity — a blended average hides the critical cases that matter most.
- Track the share of incidents contained automatically versus manually; that ratio is your leverage.
- Watch the tail, not just the median — the slow outliers are where breaches live.
The bottom line
If you track one metric, track MTTR — then track how much of it you can hand to automation. Detection tells you the attacker arrived. Response determines whether that fact ever becomes a breach. The organizations that win aren’t the ones that detect fastest; they’re the ones that contain fastest.