{"id":13702,"date":"2026-01-20T06:42:10","date_gmt":"2026-01-20T11:42:10","guid":{"rendered":"https:\/\/www.netwitness.com\/?post_type=glossary&p=13702"},"modified":"2026-01-20T08:11:23","modified_gmt":"2026-01-20T13:11:23","slug":"mean-time-to-detect-mttd","status":"publish","type":"glossary","link":"https:\/\/www.netwitness.com\/ja\/cyber-glossary\/mean-time-to-detect\/","title":{"rendered":"Mean Time to Detect (MTTD)"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is Mean Time to Detect?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Mean Time to Detect (MTTD) is a critical cybersecurity metric that measures the average time elapsed between when a security incident or breach occurs and when your security team discovers it. This performance indicator reveals how quickly your organization can <\/span>identify<\/span> threats, attacks, or anomalies within your IT environment, directly <\/span>impacting<\/span> how much damage attackers can inflict before detection.<\/span><\/span><\/p>

Unlike metrics focused on response or resolution, Mean Time to Detect specifically measures detection speed, making it a crucial gauge of your security monitoring effectiveness. Organizations with low MTTD can catch threats early in the attack lifecycle, while high MTTD indicates dangerous blind spots where attackers <\/span>operate<\/span>\u00a0undetected for extended periods, potentially exfiltrating data, deploying ransomware, or\u00a0<\/span>establishing<\/span> persistent access.<\/span><\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t