A continuous security monitoring program tracks Mean Time to Detect (MTTD). A SOC reduces MTTD from 72 hours to 4 hours. What is the primary security benefit of this improvement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because reducing dwell time directly limits the damage an attacker can cause; less time in the environment means less opportunity for lateral movement, privilege escalation, and data exfiltration. B is wrong because faster detection typically requires more analyst work, not less.
Full explanation below image
Full Explanation
A is correct because reducing dwell time directly limits the damage an attacker can cause; less time in the environment means less opportunity for lateral movement, privilege escalation, and data exfiltration. B is wrong because faster detection typically requires more analyst work, not less. C is wrong because alert volume is related to rule tuning, not detection speed. D is wrong because SIEM licensing is typically based on data volume or event rates, not detection speed.