Mean time to detect
Mean time to detect is the average elapsed time between the occurrence of an incident or failure and its identification.
Data-Driven Cybersecurity
Time to detect is the elapsed time between a security incident or breach and its identification.
- How it is used
- Tracks detection speed as an operational-continuity measure and supports decisions about security monitoring investments.
- How deep it goes
- Defines the average incident-to-detection interval and interprets targets and dashboards, but does not specify a collection or calculation procedure.
- Examples
- Uses a healthcare breach-detection target, an executive incident-response report, and a before-and-after risk dashboard.
- What you can do after
- Evaluate/understand it by comparing detection times with targets, then investigating delays before recommending changes.
Read how Data-Driven Cybersecurity explains mean time to detect →
Effective Platform Engineering
Mean time to detect is the average elapsed time from the occurrence or discovery of a failure until the responsible team is notified and can engage.
- How it is used
- Measures how effectively platform monitoring and escalation expose failures to the team responsible for fixing them.
- How deep it goes
- Defines the timing boundary and required monitoring, but stops short of specifying alert rules or escalation implementation.
- Examples
- Uses metrics, logs, traces, automated alerts, health indicators, and incident detection time as measurement artifacts.
- What you can do after
- Diagnose monitoring and alerting delays by measuring discovery-to-engagement time and comparing it with recovery metrics.
Read how Effective Platform Engineering explains mean time to detect →
Cyber Threat Hunting
Time to detect is the elapsed time between the occurrence or initiation of a security event and its detection.
- How it is used
- Reports detection performance to executives through high-value security operations metrics.
- How deep it goes
- Defines elapsed detection time and applies it to thresholds, severity categories, dashboards, and incident narratives.
- Examples
- Uses monthly executive dashboards, incident timelines, severity thresholds, six-month trends, and delayed-detection investigations.
- What you can do after
- Evaluate detection performance and communicate delayed discovery through executive security metrics and incident reports.
Read how Cyber Threat Hunting explains mean time to detect →
Related concepts
- mean time to resolutionused by · Mean time to resolution is the average elapsed time from identifying or reporting an issue, failure, or incident until it is resolved or affected service is restored.
- metrickind of · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.
- data breachmeasures · A data breach is a security incident in which protected or sensitive data is accessed, disclosed, altered, acquired, or otherwise compromised without authorization.
- direct metrickind of · A direct metric is a measurement obtained by directly observing and recording the attribute, event, or phenomenon it represents.
- thresholdconfigured by · A threshold is a boundary value against which a quantity is compared to determine whether a condition is met or an action or decision is triggered.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.