Mean time to detect (MTTD) is the average time between the start of an incident and the moment defenders discover it. It measures how long an attacker can remain unnoticed, whether the first clue is a suspicious login, unusual network traffic, malware telemetry, or a user report.
MTTD matters because every extra hour of undetected activity gives an attacker more time to steal data, move laterally, or disable systems. A low MTTD usually means better visibility from logs, endpoints, and cloud services, plus strong alerting and threat-hunting processes. A high MTTD can indicate blind spots, weak monitoring, or alerts that are too noisy to investigate quickly. In real defenses, teams try to reduce MTTD with baselines, correlation rules, anomaly detection, and trained analysts who can turn raw signals into a confirmed incident.