Cybersecurity Glossary
Mean Time to Detect
The average time between something bad starting and somebody noticing it.
What Mean Time to Detect means
Detection time is measured from the first attacker action to the moment a human becomes aware, not to the moment a tool logged something. The gap between those two is where most of the damage happens, because an attacker who is not being watched moves at their own pace.
Why Mean Time to Detect matters for small businesses and nonprofits
For a small organisation the honest figure is often measured in weeks, because the only detection is a customer or a bank calling. Improving it rarely means buying more tools. It usually means deciding who reads the alerts and when.
What to do about Mean Time to Detect
- Name the person who reads security alerts, and the day of the week they do it
- Turn on alerting for the handful of events that would matter most, and mute the rest
- Measure detection time after any incident, however small, and write the number down
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.
The average time between something bad starting and somebody noticing it.