Skip to content
Calcrivo

MTTD Calculator

Break mean time to detect into dwell, telemetry lag, rule interval, queue delay and analyst confirmation, and find the bottleneck.

Inputs

hours

Time from initial compromise until the attacker touches something you instrument.

minutes
minutes

A rule running every 15 minutes adds 7.5 minutes of latency on average.

minutes
minutes
days

Industry breach reports commonly cite 180–210 days to identify an incident.

Mean Time to Detect

9.29hours

MTTD as a Duration

9h 18m

Detection Pipeline Latency

77.5minutes

Everything after the attacker becomes visible.

Share of MTTD That Is Pre-Signal Dwell

86.1%

Slowest Phase

Slowest phase: pre-signal dwell (480 min, 86.1% of MTTD)

Faster Than Benchmark By

501.1×

Step by step

  1. Values used

    Dwell before any signal is generated = 8 hours; Telemetry collection and shipping lag = 5 minutes; Scheduled rule interval = 15 minutes; Alert queue wait before triage = 40 minutes; Analyst confirmation time = 25 minutes; Benchmark dwell time to compare against = 194 days

  2. MTTD

    MTTD = pre-signal dwell + telemetry lag + (rule interval ÷ 2) + queue wait + analyst confirmation.

  3. Dwell share

    Dwell share = pre-signal dwell ÷ MTTD, which separates a telemetry gap from a pipeline problem.

  4. Mean Time to Detect

    = 9.29 hours

  5. MTTD as a Duration

    = 557.50

  6. Detection Pipeline Latency

    = 77.5 minutes

  7. Share of MTTD That Is Pre-Signal Dwell

    = 86.1

  8. Slowest Phase

    = Slowest phase: pre-signal dwell (480 min, 86.1% of MTTD)

  9. Faster Than Benchmark By

    = 501.1 ×

How it works

Halving the rule interval is the right adjustment for a scheduled search: if a rule runs every fifteen minutes, activity arrives uniformly across the window, so the expected wait is 7.5 minutes. Summing the phases makes it obvious whether MTTD is dominated by missing telemetry or by a slow pipeline. MTTD sets the ceiling on how much damage an intrusion can do, and the two fixes — more telemetry versus a faster pipeline — cost entirely different amounts, so knowing which phase dominates is what makes the metric actionable.

Formulas

MTTD

MTTD = pre-signal dwell + telemetry lag + (rule interval ÷ 2) + queue wait + analyst confirmation.

pre-signal dwell
Attacker time before touching instrumented ground
rule interval ÷ 2
Mean wait for the next scheduled run
queue wait
Time the alert sits before a human opens it

Dwell share

Dwell share = pre-signal dwell ÷ MTTD, which separates a telemetry gap from a pipeline problem.

dwell share
Portion of detection time you cannot fix with faster tooling

Frequently Asked Questions

How is MTTD calculated?

MTTD = pre-signal dwell + telemetry lag + (rule interval ÷ 2) + queue wait + analyst confirmation. Halving the rule interval is the right adjustment for a scheduled search: if a rule runs every fifteen minutes, activity arrives uniformly across the window, so the expected wait is 7.5 minutes. Summing the phases makes it obvious whether MTTD is dominated by missing telemetry or by a slow pipeline.

Why does MTTD matter?

MTTD sets the ceiling on how much damage an intrusion can do, and the two fixes — more telemetry versus a faster pipeline — cost entirely different amounts, so knowing which phase dominates is what makes the metric actionable.

What values do I need to enter?

This calculator takes 6 inputs: Dwell before any signal is generated, Telemetry collection and shipping lag, Scheduled rule interval, Alert queue wait before triage, Analyst confirmation time, Benchmark dwell time to compare against. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why separate dwell from pipeline latency?

Because they have different owners. Pre-signal dwell shrinks by instrumenting more of the estate — identity, EDR, cloud control plane — while pipeline latency shrinks by shortening rule intervals, streaming instead of batching, and staffing the queue. Reporting one number hides which lever to pull.

How do I measure pre-signal dwell honestly?

From post-incident timelines: the gap between the earliest attacker action you can evidence and the first log entry that could have alerted. If forensics cannot reach the initial access, treat your figure as a lower bound and say so.

You might also need