MTTD Calculator
Break mean time to detect into dwell, telemetry lag, rule interval, queue delay and analyst confirmation, and find the bottleneck.
Inputs
Time from initial compromise until the attacker touches something you instrument.
A rule running every 15 minutes adds 7.5 minutes of latency on average.
Industry breach reports commonly cite 180–210 days to identify an incident.
Mean Time to Detect
9.29hours
MTTD as a Duration
9h 18m
Detection Pipeline Latency
77.5minutes
Everything after the attacker becomes visible.
Share of MTTD That Is Pre-Signal Dwell
86.1%
Slowest Phase
Slowest phase: pre-signal dwell (480 min, 86.1% of MTTD)
Faster Than Benchmark By
501.1×
Step by step
Values used
Dwell before any signal is generated = 8 hours; Telemetry collection and shipping lag = 5 minutes; Scheduled rule interval = 15 minutes; Alert queue wait before triage = 40 minutes; Analyst confirmation time = 25 minutes; Benchmark dwell time to compare against = 194 days
MTTD
MTTD = pre-signal dwell + telemetry lag + (rule interval ÷ 2) + queue wait + analyst confirmation.
Dwell share
Dwell share = pre-signal dwell ÷ MTTD, which separates a telemetry gap from a pipeline problem.
Mean Time to Detect
= 9.29 hours
MTTD as a Duration
= 557.50
Detection Pipeline Latency
= 77.5 minutes
Share of MTTD That Is Pre-Signal Dwell
= 86.1
Slowest Phase
= Slowest phase: pre-signal dwell (480 min, 86.1% of MTTD)
Faster Than Benchmark By
= 501.1 ×
How it works
Halving the rule interval is the right adjustment for a scheduled search: if a rule runs every fifteen minutes, activity arrives uniformly across the window, so the expected wait is 7.5 minutes. Summing the phases makes it obvious whether MTTD is dominated by missing telemetry or by a slow pipeline. MTTD sets the ceiling on how much damage an intrusion can do, and the two fixes — more telemetry versus a faster pipeline — cost entirely different amounts, so knowing which phase dominates is what makes the metric actionable.
Formulas
MTTD
MTTD = pre-signal dwell + telemetry lag + (rule interval ÷ 2) + queue wait + analyst confirmation.
- pre-signal dwell
- Attacker time before touching instrumented ground
- rule interval ÷ 2
- Mean wait for the next scheduled run
- queue wait
- Time the alert sits before a human opens it
Dwell share
Dwell share = pre-signal dwell ÷ MTTD, which separates a telemetry gap from a pipeline problem.
- dwell share
- Portion of detection time you cannot fix with faster tooling
Frequently Asked Questions
How is MTTD calculated?
MTTD = pre-signal dwell + telemetry lag + (rule interval ÷ 2) + queue wait + analyst confirmation. Halving the rule interval is the right adjustment for a scheduled search: if a rule runs every fifteen minutes, activity arrives uniformly across the window, so the expected wait is 7.5 minutes. Summing the phases makes it obvious whether MTTD is dominated by missing telemetry or by a slow pipeline.
Why does MTTD matter?
MTTD sets the ceiling on how much damage an intrusion can do, and the two fixes — more telemetry versus a faster pipeline — cost entirely different amounts, so knowing which phase dominates is what makes the metric actionable.
What values do I need to enter?
This calculator takes 6 inputs: Dwell before any signal is generated, Telemetry collection and shipping lag, Scheduled rule interval, Alert queue wait before triage, Analyst confirmation time, Benchmark dwell time to compare against. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why separate dwell from pipeline latency?
Because they have different owners. Pre-signal dwell shrinks by instrumenting more of the estate — identity, EDR, cloud control plane — while pipeline latency shrinks by shortening rule intervals, streaming instead of batching, and staffing the queue. Reporting one number hides which lever to pull.
How do I measure pre-signal dwell honestly?
From post-incident timelines: the gap between the earliest attacker action you can evidence and the first log entry that could have alerted. If forensics cannot reach the initial access, treat your figure as a lower bound and say so.