thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Mean Time to Detect (MTTD)

The average time between when an incident begins and when it is detected.

Definition

MTTD measures detection effectiveness; lower values mean attackers have less time to act. It is calculated across incidents over a period. Improving telemetry, analytics and hunting reduces MTTD.

Example

If three incidents were detected after 2, 6 and 10 hours, MTTD is 6 hours.

Exam tip

MTTD is about detection speed; MTTR is about response or recovery speed.

Related terms