What are MTTD and MTTR?

MTTD (Mean Time to Detect) is the average time between an attack starting and someone noticing it. MTTR (Mean Time to Respond, sometimes to Recover) is the average time from noticing to containing or fixing it. Both are used to measure how well a security programme works, and both should go down over time. For a small company, honest rough numbers are more useful than precise ones: when did we last find something, how did we find it, and how long did it take to act? If the answer is that someone outside the company told you, detection is the gap to fix first.

← All 69 questions on What is…? Network and security termsAll topics