Mean Time To Detect (MTTD) Calculator
Reviewed by Hamza Gujjar, Algorithm Architect & Software Developer
Last updated: July 27, 2026Mean Time To Detect (MTTD) Calculator
MTTD measures how long a threat sits undiscovered in an environment before a security team notices it - one of the most closely watched metrics in any security operations center (SOC).
MTTD = Detection Time - Incident Start Time
Worked Example
- Incident start: hour 0
- Detection time: hour 72
MTTD = 72 - 0 = 72 hours (3.0 days)
Why It Matters
The longer a threat goes undetected, the more time an attacker has to move laterally across the network, escalate privileges, and locate and exfiltrate valuable data. Industry breach investigation reports have historically found average detection times measured in weeks to months for undiscovered intrusions, which is exactly why organizations invest heavily in continuous monitoring, log correlation, and threat detection tooling designed specifically to compress this number. See also the related Mean Time To Respond Calculator for the other half of incident response speed.