0Pricing
Cyber Security Academy · Lesson

SOC Metrics: MTTD and MTTR

Measuring detection and response speed.

SOC Metrics: MTTD and MTTR is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Metrics Matter

A SOC without metrics is flying blind. Metrics tell you whether the team is detecting threats faster, responding quicker, and improving over time.

The two headline metrics are MTTD (Mean Time To Detect) and MTTR (Mean Time To Respond/Resolve). They quantify the two most important questions: How fast do we see threats, and how fast do we stop them?

Mean Time To Detect (MTTD)

MTTD measures the average time between when an attack begins and when the SOC detects it.

A low MTTD means attackers have less dwell time inside the environment. Every hour of undetected access lets an attacker move laterally, escalate privileges, and stage data for exfiltration.

Reducing MTTD usually means better detection coverage, tuned rules, and richer telemetry.

Mean Time To Respond (MTTR)

MTTR measures the average time from detection to resolution. It captures how fast the SOC contains and remediates a confirmed threat.

MTTR is sometimes split further:

  • Time to acknowledge — detection to an analyst picking it up
  • Time to contain — stopping the threat from spreading
  • Time to recover — full restoration to normal

Always check which definition your team uses, because 'respond' and 'resolve' are not the same.

Calculating the Means

Both metrics are simple averages across a set of incidents over a time window.

MTTD = sum(detection_time - attack_start_time) / number_of_incidents

MTTR = sum(resolution_time - detection_time) / number_of_incidents

# Example for 3 incidents (MTTR in hours):
# (2 + 5 + 8) / 3 = 5.0 hours mean time to respond

The Timeline of an Incident

Visualizing the timeline clarifies what each metric measures:

Attack starts -----> Detected -----> Acknowledged -----> Contained -----> Resolved
      |-------- MTTD --------|
               |----------------- MTTR -----------------|

Dwell time = attack start to detection (you want this SMALL)

The Dwell Time Problem

Dwell time is the period an attacker operates undetected. It is essentially the real-world consequence of MTTD.

Industry reports historically measured median dwell times in weeks or months, though detection has improved. The longer the dwell, the more damage:

  • More systems compromised
  • More data accessed
  • Harder, costlier cleanup

Shrinking dwell time is one of the clearest signs a SOC is maturing.

Other Useful SOC Metrics

MTTD and MTTR are headline numbers, but they need supporting metrics for full context:

  • Alert volume — total alerts per day
  • False positive rate — share of alerts that are not real
  • Escalation rate — alerts that move beyond Tier 1
  • SLA compliance — percent of alerts handled within target time
  • Analyst workload — alerts per analyst per shift

Together these reveal whether the SOC is effective and sustainable.

Watching for False Positives

A high false positive rate silently destroys SOC performance. Analysts waste time, get fatigued, and may start ignoring noisy alerts, a dangerous condition called alert fatigue.

If 95% of a rule's alerts are false positives, that rule needs tuning, not more analyst hours. Tracking false positive rate per rule tells you exactly where to focus tuning effort.

Avoiding Metric Gaming

Metrics drive behavior, sometimes the wrong behavior. If you only reward low MTTR, analysts may close tickets prematurely to hit the number.

Watch for gaming patterns:

  • Closing cases before they are truly resolved
  • Reclassifying real incidents as false positives
  • Suppressing noisy detections instead of fixing them

Pair speed metrics with quality measures like reopened-ticket rate so fast does not mean sloppy.

Data Quality Drives Metrics

Your metrics are only as good as your timestamps. If analysts forget to update ticket status, MTTD and MTTR become meaningless.

Reliable metrics require:

  • Accurate detection and resolution timestamps
  • Consistent severity classification
  • Honest disposition (true positive vs false positive)

This is why disciplined ticketing from the previous lesson directly powers good metrics here.

Using Metrics to Improve

Metrics are only valuable if they drive action. Review them regularly and ask what they are telling you:

  • MTTD rising? Detection coverage may have gaps.
  • MTTR rising? Response process or staffing may be bottlenecked.
  • False positive rate climbing? A rule needs tuning.

The goal is a feedback loop: measure, identify weaknesses, improve detections and processes, then measure again.

Quick Check

Test your understanding of SOC metrics.

Recap

You learned how to measure SOC performance:

  • MTTD = time from attack start to detection; lower means less dwell time
  • MTTR = time from detection to response/resolution; confirm which definition is used
  • Support metrics include alert volume, false positive rate, escalation rate, and SLA compliance
  • Watch for alert fatigue and metric gaming; pair speed with quality measures
  • Accurate timestamps and disciplined ticketing make metrics trustworthy, feeding a continuous improvement loop

This completes the SOC Analyst Operations and Triage course.

Frequently asked questions

Is the “SOC Metrics: MTTD and MTTR” lesson free?

Yes — the full text of “SOC Metrics: MTTD and MTTR” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “SOC Metrics: MTTD and MTTR”?

Measuring detection and response speed. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “SOC Metrics: MTTD and MTTR” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. The SOC and Its Tiers
  2. Alert Triage Workflow
  3. Playbooks and Ticketing
  4. SOC Metrics: MTTD and MTTR
← Back to Cyber Security Academy