Mean time to resolution (MTTR) is the average time needed to resolve security incidents. For a consistent measure, resolution time runs from detection through recovery. MTTR gives leaders a concise view of how long incidents remain unresolved, but it should be read alongside incident severity and business impact. section 2.2.3 section 9.5.2
Make the number useful for decisions:
- Compare MTTR across incident categories, such as phishing and malware, rather than relying only on one overall average. section 2.2.3
- Show it beside critical incidents, risk exposure, and financial consequences so faster resolution is connected to business risk. section 2.2.3
- Keep the label precise: time to respond and time to fully resolve describe different points in the incident life cycle. Confirm which one a dashboard measures before comparing results. section 4.3.1 section 9.5.2
Reading an executive dashboard
An executive dashboard reports two days for phishing-incident MTTR. That figure is more actionable when compared with other incident categories and presented alongside critical-incident counts and financial consequences. A separate response-time result—for example, an improvement from three hours to one hour after automated escalation—can show operational progress, but should not be presented as a reduction in full resolution time without matching measurement boundaries. section 2.2.3 section 3.4.2 section 9.5.2
Table 2.3 Executive dashboard example values
| Metric |
Value |
| Risk exposure score |
7.5 |
| SOC 2 compliance % |
85% |
| HIPAA compliance % |
90% |
| Critical security incidents (Q3) |
5 |
| MTTR (phishing incidents) |
2 days |
| Financial consequences (Q3) |
$150k |
The sample executive values place phishing MTTR beside risk, compliance, critical incidents, and financial consequences. section 2.2.3
