SOC Metrics: MTTD and MTTR

A SOC without metrics is flying blind. Metrics tell you whether the team is detecting threats faster, responding quicker, and improving over time.

The two headline metrics are MTTD (Mean Time To Detect) and MTTR (Mean Time To Respond/Resolve). They quantify the two most important questions: How fast do we see threats, and how fast do we stop them?

MTTD measures the average time between when an attack begins and when the SOC detects it.

A low MTTD means attackers have less dwell time inside the environment. Every hour of undetected access lets an attacker move laterally, escalate privileges, and stage data for exfiltration.

Reducing MTTD usually means better detection coverage, tuned rules, and richer telemetry.