Definition
Mean time to detect (MTTD) quantifies the average duration it takes for an organization to identify a security threat or incident after it has occurred. This metric tracks the interval from the initial compromise or malicious activity to the moment it is recognized by security personnel or automated systems. Understanding MTTD is crucial for assessing the effectiveness of an organization's threat detection capabilities and response readiness. For instance, if a phishing attack successfully compromises an employee's credentials, MTTD measures how long it takes before IT security notices unusual login activity or other indicators. MTTD is often confused with Mean time to respond (MTTR), which measures the time taken to remediate an incident after detection. This concept is relevant for cybersecurity certifications like CompTIA Security+ and CySA+.