Topic starter
06/09/2026 9:02 am
TL;DR: MTTD, MTTC and MTTR can look better than reality because MTTD only measures incidents that were investigated, while the average enterprise SOC handles 4,330 alerts a day and investigates 37% of them, according to Crogl. The real governance issue is coverage, because unworked alerts can leave threats undetected until damage forces a second look.
Editorial analysis by NHI Mgmt Group, based on content published by Crogl: “MTTD, MTTC, and MTTR: The SOC Metrics That Measure Detection”.
Key questions
Q: How should security teams measure MTTD without hiding uninvestigated alerts?
A: Measure MTTD on top of a separate coverage metric that shows what share of the alert queue was actually investigated.
Q: Why does low alert coverage distort SOC performance reporting?
A: Low coverage means the SOC is averaging only the alerts it had time to touch, not the alerts that actually existed.
Q: What are the signs that a SOC is measuring only a partial alert workload?
A: Common signs include improving MTTD while backlog age rises, analysts clearing routine alerts but deferring complex ones, and incident volumes that do not align with alert intake.
Practitioner guidance
- Track alert coverage alongside MTTD Report the share of alerts actually investigated in the same view as mean time to detect so the metric cannot hide unworked queue volume.
- Define consistent metric boundaries Fix start and stop points for detection, containment and response, and keep those definitions stable across reporting periods.
- Measure backlog age and arrival rate Monitor how quickly alerts accumulate versus how quickly analysts clear them so queue growth is visible before it distorts performance reporting.
Bottom line: MTTD, MTTC and MTTR can all improve on paper while a growing slice of alerts never gets investigated at all.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 9:02 am
Coverage is the missing SOC control because detection metrics are only as honest as the queue they sample. MTTD, MTTC and MTTR describe performance after an alert has entered the investigative path, which means they can improve even while unworked alerts accumulate outside the measurement boundary. That is a governance failure, not a dashboard quirk. Practitioners should judge whether the SOC is measuring the whole alert population or only the portion it can clear.
A question worth separating out:
Q: Should organisations prioritise detection tuning or response automation first?
A: Start with the detection paths that already lead to the highest-risk outcomes, then automate only the response actions you can safely reverse or audit. If tuning is too weak, automation amplifies bad decisions. If response is absent, good detections still arrive too late to matter.
👉 Read our full editorial: MTTD, MTTC and coverage: the SOC metric blind spot