A city CIO funds more unused Enterprise Security dashboards and claims mean time to detect will drop. What does MTTD actually measure?

Mean time to detect (MTTD) is the interval from occurrence of malicious or suspicious activity to awareness—typically a notable, hunt hit, or equivalent trigger in the municipal SOC. Funding more unused Enterprise Security dashboards does not shorten that interval; scheduled detections that fire on the right civic telemetry do. Measuring how colorful the Security Posture dashboard is during a council briefing fails by concept because aesthetics and briefing graphics are not detection latency. Measuring how many notables the queue can hold before it pages anyone fails by concept because queue capacity is a workload or alerting threshold issue, not MTTD. Measuring time from detection until the threat is contained or resolved fails by concept because that interval is MTTR (or related response time), not MTTD. Exam caveat: SPLK-5001 expects MTTD as occurrence-to-detection, improved by effective analytics and data onboarding—not by unused dashboards or confusing MTTD with MTTR. Operational check: sample recent true civic incidents, record first malicious timestamp versus first notable or hunt awareness, publish MTTD separately from MTTR, and retire or fix unused dashboards that do not contribute detections.