Security MTTR Calculator
Compute security mean time to respond across detect, triage, contain, eradicate and recover phases, with automation savings.
About Security MTTR Calculator
Automation is applied unevenly on purpose: SOAR enrichment and auto-closure remove most of the triage minutes, but containment still needs approvals, change windows and a human decision to isolate a production host, so only about 60% of the automation share carries through. MTTR is the headline SOC metric in most board packs, and decomposing it stops the common trap of celebrating faster triage while containment — the phase that actually limits damage — stays measured in days.
Formulas
Security MTTR
MTTR = detect + triage + contain + eradicate + recover, with triage reduced by the automation share and containment by 60% of it.
- detect
- Compromise to alert confirmed
- triage
- Alert to validated incident
- contain
- Validated to attacker action stopped
- eradicate
- Removing persistence and access
- recover
- Restoring and verifying service
Mean time to contain
Mean time to contain = detect + triage + contain — the metric that tracks damage, since eradication and recovery happen after the bleeding stops.
- MTTC
- Mean time to contain
- damage window
- Period during which the attacker still has access
Worked example
With the default values below, Security MTTR Calculator returns Mean Time to Respond of 20.26. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Detect phaseaccepts 0–100,000 minutes
- 480 minutes
- Triage and validate phaseaccepts 0–100,000 minutes
- 45 minutes
- Contain phaseaccepts 0–100,000 minutes
- 120 minutes
- Eradicate phaseaccepts 0–100,000 minutes
- 360 minutes
- Recover and verify phaseaccepts 0–100,000 minutes
- 240 minutes
- Triage and containment steps automatedaccepts 0–100 %
- 25 %
- Incidents of this class per yearaccepts 0–100,000 incidents/year
- 24 incidents/year
Results
- Mean Time to Respond
- 20.26 hours
- MTTR as a Duration
- 20h 16m
- Mean Time to ContainDetect through contain — when the bleeding stops.
- 10.26 hours
- Minutes Saved by Automation
- 29 minutes
- Slowest Phase
- Slowest phase: detect (8 h, 39.5% of MTTR)
- Annual Response Effort
- 486.3 hours/year
Step by step
- 1Values used
- 2Security MTTR
- 3Mean time to contain
- 4Mean Time to Respond= 20.26 hours
- 5MTTR as a Duration= 1,215.75
- 6Mean Time to Contain= 10.26 hours
- 7Minutes Saved by Automation= 29 minutes
- 8Slowest Phase= Slowest phase: detect (8 h, 39.5% of MTTR)
- 9Annual Response Effort= 486.3 hours/year
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or fees or charges into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Security MTTR calculated?
MTTR = detect + triage + contain + eradicate + recover, with triage reduced by the automation share and containment by 60% of it. Automation is applied unevenly on purpose: SOAR enrichment and auto-closure remove most of the triage minutes, but containment still needs approvals, change windows and a human decision to isolate a production host, so only about 60% of the automation share carries through.
Why does Security MTTR matter?
MTTR is the headline SOC metric in most board packs, and decomposing it stops the common trap of celebrating faster triage while containment — the phase that actually limits damage — stays measured in days.
What values do I need to enter?
This calculator takes 7 inputs: Detect phase, Triage and validate phase, Contain phase, Eradicate phase, Recover and verify phase, Triage and containment steps automated, Incidents of this class per year. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is MTTR or MTTC the better metric?
MTTC drives risk; MTTR drives cost. Containment ends the attacker's access, so it bounds the damage, while eradication and recovery mostly consume engineering hours. Track both and never let a good MTTR hide a slow containment.
Should MTTR include out-of-hours waiting?
Yes, if that is what really happens. Excluding nights and weekends produces a flattering number that no longer describes your exposure. Measure wall-clock, then use the gap between wall-clock and working-hours MTTR as the business case for 24×7 coverage.