What Is MTTD? Strategies to Reduce Mean Time to Detect

Why MTTD is an important metric to monitor

MTTD is a key metric for determining whether an organization is improving or degrading its ability to respond to attacks. It can provide a baseline for measuring an organization's effectiveness and allow it to observe whether it is moving in the right direction. Changes in MTTD can also provide an opportunity to proactively evaluate aspects of security operations centers’ (SOCs) methods and toolsets. Degradation in MTTD can provide an opportunity to identify the cause and take action to address it.

For example, when an incident increases the MTTD security leaders can pursue several lines of inquiry: 

• Was the increase due to adversaries changing their tactics, techniques, and procedures (TTPs) in response to existing defenses?
• Does it indicate shortcomings of existing detection tools and techniques? 
• Is additional training needed to help staff recognize this change? 
• Has something changed in the organization’s architecture that has created a new blind spot in current detection capabilities? 

To maximize the metric’s utility, MTTD should be documented at regular intervals so that changes can be tracked over time.

As organizations build their security strategy, capabilities, and procedures, they can monitor the impact that they have in reducing the MTTD by continuing to ask questions about actual performance, such as: 

• How did a new threat hunting effort help improve the ability to detect an adversary? 
• What information will be needed to demonstrate the value of an improvement in network monitoring? 

Along with other key metrics, MTTD gives security leaders an accessible measurement that helps explain to business leaders how well their security defenses are performing and returning on their investments. 

Additionally, tracking MTTD over time allows for easier communication with auditors and other stakeholders about how well the security program is working. Many regulatory frameworks require timely detection of incidents, so tracking MTTD allows organizations to show how their efforts have improved their detection capabilities.

How to calculate MTTD

The first step for calculating MTTD is for organizations to determine the threshold for malicious activity to be considered an incident. Is it when an adversary has interactive access to a host or when malware is successfully executed on a host? Once organizations start tracking their incidents, they can start determining Time to Detection for each individual incident. 

At this point, calculating the MTTD is a simple task. The formula is:

MTTD = Sum of Time to Detect for All Incidents / Number of Incidents

If an organization is just starting to track the MTTD, then it will take some time for the metric to stabilize and become meaningful, as it will be heavily influenced by the latest incident. Once this stabilization occurs, organizations can use it to monitor how their security program is doing at quickly detecting security incidents.