MTTD

MTTD measures the average time between an attack starting and the defense team noticing it. It is one of the most important SOC metrics, since undetected attackers can quietly steal data or spread for weeks. Driving MTTD down through better telemetry and detection rules directly limits the blast radius of a breach.