Measures the average duration required to contain, eradicate, and recover from an incident after it has been detected. It gauges how efficiently an organization can restore normal operations and mitigate damage once a threat is identified.
MTTR Formula
Loading formula...Where:
- Loading formula...The timestamp when incident i was first identified as a legitimate security event.
- Loading formula...The timestamp when incident i was fully remediated and normal operations restored.
- Loading formula...The total number of incidents included in the calculation.
A low MTTR reflects well-defined playbooks, effective automation, and strong cross-team coordination. High MTTR values, on the other hand, often result from unclear escalation paths, limited tool integration, or manual workflows.
Organizations improve MTTR through orchestration and automation tools (SOAR), well-rehearsed response procedures, and collaborative SecOps environments. While detection speed (MTTD) determines how quickly a threat is seen, response speed (MTTR) determines how effectively it’s neutralized—making both metrics vital benchmarks of security maturity.
Additional Acronyms for MTTR
- MTTR - Mean Time to Repair