thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Mean Time to Respond (MTTR)

The average time between detecting an incident and containing or resolving it.

Definition

In security operations, MTTR measures response efficiency from detection to containment or remediation, depending on the organization's definition. Automation, clear playbooks and pre-authorized actions reduce it. Note that MTTR also commonly means mean time to repair in reliability contexts.

Example

An alert detected at 10:00 with the host isolated at 10:25 contributes 25 minutes.

Exam tip

Check context: MTTR in SOC metrics = respond; in BC/DR = repair or recover.

Related terms