Mean Time to Detect & Respond (MTTR) Calculator
Calculate your organization's Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) metrics based on incident data. These metrics are critical KPIs for security operations and IT teams.
Enter how many incidents to analyze (1–20)
| Incident # | Occurrence Time (hrs from epoch) | Detection Time (hrs) | Resolution Time (hrs) |
|---|
Formulas
Mean Time to Detect (MTTD):
MTTD = Σ (Detection Timei − Occurrence Timei) / N
Mean Time to Respond / Resolve (MTTR):
MTTR = Σ (Resolution Timei − Occurrence Timei) / N
Mean Time to Contain (MTTC):
MTTC = MTTR − MTTD (average time from detection to resolution)
Where N is the total number of incidents analyzed.
Assumptions & References
- All time inputs are in the same unit (hours) relative to an arbitrary epoch (e.g., start of month).
- Detection Time must be ≥ Occurrence Time (you cannot detect before it happens).
- Resolution Time must be ≥ Detection Time (you cannot resolve before detecting).
- MTTD measures how quickly your monitoring/alerting identifies an incident.
- MTTR (Mean Time to Respond/Resolve) measures total incident lifecycle from occurrence to resolution.
- MTTC (Mean Time to Contain) isolates the response effort after detection.
- Industry benchmarks: MTTD < 1 hour and MTTR < 4 hours are considered strong for security operations (IBM Cost of a Data Breach Report 2023).
- Reference: NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide.
- Reference: IBM Security — Cost of a Data Breach Report 2023.