4.3 Metrics That Actually Matter
Most guides mention MTTR without defining it. Here are 4 metrics with precise definitions.
# | Metric | Definition | Formula | Owner | What “Good” Looks Like |
1 | MTTD (Mean Time to Detect) — SOC | Average time from ADR alert generation to SOC analyst acknowledging/opening the alert in the SIEM | Σ(alert_acknowledged_time - alert_created_time) / count(alerts) | SOC Leader | Level 1: < 4 hrs Level 2: < 1 hr Level 3: < 15 min |
2 | MTTT (Mean Time to Triage) — SOC | Average time from alert acknowledgement to triage decision (escalate/close /investigate) | Σ(triage_decision_time - alert_acknowledged_time) / count(alerts) | SOC Leader | Level 1: < 2 hrs Level 2: < 30 min Level 3: < 10 min |
3 | MTTR (Mean Time to Remediate) — AppSec | Average time from vulnerability discovery (by ADR) to verified fix in production | Σ(patch_verified_in_prod_time - vuln_first_detected_time) / count(vulns) | AppSec Leader | Level 1: < 90 days Level 2: < 30 days Level 3: < 14 days (for Critical/High) |
4 | Block Coverage % — AppSec | Percentage of Tier 1/2 applications with Block Mode enabled for high-confidence rules | count(apps_with_block_mode) / count(tier1_and_tier2_apps) × 100 | AppSec Leader | Level 1: 0% (Monitor only) Level 2: > 50% Tier 1 Level 3: > 80% Tier 0+1 |
How to use these metrics: