MTTR

MTTR measures the average time it takes a team to respond to and resolve a security incident after it is detected. The longer an attacker stays active, the more damage they can do, so SOC leaders track MTTR to judge how efficient their processes and tooling are and to justify investments in automation.