How can you measure the time it takes to detect a security incident?

1 What is MTTD?

MTTD is the average time between the occurrence of a security incident and its detection by your security team or tools. It is usually measured in hours or days, and it indicates how quickly you can identify and contain a potential threat. MTTD is one of the key performance indicators (KPIs) for security incident response, along with mean time to respond (MTTR) and mean time to resolve (MTTR).

2 How to calculate MTTD?

To calculate MTTD, you need to collect and analyze data from your security logs, alerts, and reports. You need to identify the timestamp of the first evidence of a security incident, such as a suspicious network activity, a malware infection, or a data breach. Then, you need to compare it with the timestamp of the first detection by your security team or tools, such as an alert, a notification, or a ticket. The difference between these two timestamps is the time to detect for that incident. To get the MTTD, you need to calculate the average of the time to detect for all the incidents in a given period, such as a month or a quarter.

3 Why does MTTD matter?

MTTD matters because it affects the impact and cost of a security incident. The longer it takes to detect an incident, the more damage it can cause to your systems, data, reputation, and compliance. According to a study by IBM, the average cost of a data breach in 2020 was $3.86 million, and the average time to identify and contain a breach was 280 days. The study also found that organizations that detected and contained a breach in less than 200 days saved more than $1 million compared to those that took more than 200 days. Therefore, reducing MTTD can help you minimize the risk and loss of a security incident.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?