A city CIO funds more unused Enterprise Security dashboards and claims mean time to detect will drop. What does MTTD actually measure?
Select an answer to reveal the explanation.
Short Explanation
MTTD is the clock from 'it happened' to 'we noticed.' Extra dashboards nobody watches are wallpaper, not detection. Time from notice to isolate is MTTR, a different clock.
Full Explanation
Mean time to detect (MTTD) is the interval from occurrence of malicious or suspicious activity to awareness—typically a notable, hunt hit, or equivalent trigger. Unused or noisy dashboards do not shorten that interval; detections that fire on the right civic telemetry do. Time from detection to containment or resolution is MTTR, not MTTD. Dashboard aesthetics and queue capacity are not MTTD.