MTTD exists because time is the defining variable in a breach. The longer an attacker operates undetected, the more they can do: establish persistence, move laterally, find and stage data, and prepare the final objective. The majority of the damage in a serious breach occurs in the gap between intrusion and detection — the dwell time. Reducing that gap, measured as MTTD, is therefore one of the most direct ways to reduce the impact of a breach. A detection that fires in minutes rather than weeks is the difference between a contained incident and a board-level crisis.
MTTD is driven by several factors. Coverage is the most fundamental: detection can only be as fast as the telemetry the SOC receives, so environments with gaps in logging, unmonitored systems, or blind spots will have higher MTTD for threats in those gaps. Detection quality matters next — a well-engineered detection fires on real threats with few false positives, while a poorly tuned one is either noisy (ignored) or silent (misses the threat). The human layer — analysts reviewing and triaging alerts — sets a floor on MTTD, because even a perfect detection has to be noticed, investigated, and confirmed.
Reducing MTTD is therefore a programme rather than a single purchase. It means expanding telemetry coverage to close blind spots, engineering detections for known threat behaviours rather than just signatures, tuning out false positives so analysts can act on what remains, and operating 24/7 so that a detection at 3am is not ignored until the morning. It also means proactive hunting — searching for threats the detections did not flag — because no detection set is complete and the threats that evade it are exactly the ones that drive dwell time.
MTTD is one of the two metrics that should be in any managed detection or SOC contract, and it should be published, measured, and reported — not just promised. A provider that will not commit to an MTTD SLA is a provider that is probably not measuring it, and a customer that does not track its own MTTD has no way to know whether its detection is improving. Benchmarks vary by environment and threat type, but the comparison that matters is relative: is MTTD going down over time, and how does it compare to the industry's reported dwell times?
Passeca publishes MTTD as part of its SOC-as-a-Service and MDR service-level agreements, alongside MTTR. The service is engineered to drive MTTD down through broad telemetry coverage on PassIRP, AI-assisted triage on PassAI-Guard that accelerates the human review step, deception technology that provides near-instant high-confidence detections, and 24/7 staffing so that detections are acted on continuously. The published SLA is backed by reporting, so customers can see the actual detection performance over time.