MTTD
also: Mean Time To Detect
Mean Time To Detect (MTTD) is the average duration between when a security incident or system failure occurs and when it is first identified or discovered.
Mean Time To Detect (MTTD) is a critical security and operations metric that measures how quickly your organization can identify that a breach, intrusion, or system failure has happened. A lower MTTD is better—it means you catch problems faster.
In Linux environments, MTTD is improved through monitoring tools, log analysis, intrusion detection systems (IDS), and security information and event management (SIEM) platforms. For example, if a rootkit compromises a server at 2:00 PM but isn't detected until 6:00 PM, your MTTD for that incident is 4 hours.
Organizations track MTTD alongside related metrics like MTTR (Mean Time To Respond) and MTBF (Mean Time Between Failures) to understand security posture and system reliability. Reducing MTTD minimizes damage from undetected breaches and allows faster incident response.