MTTR

MTTR measures the average time it takes a team to respond to and resolve a security incident after it is detected. SOC leaders track it to judge how efficient their processes and tooling are, and to justify investments in automation. It matters because the longer an attacker stays active, the more damage they can do.