MTTR Is Lying to You

Mean time to resolve is the metric every security operations deck leads with, and it is quietly one of the most misleading numbers we report. Not because it’s wrong, but because it only measures the incidents you found. MTTR is a story about your wins told by the survivors. The incidents that never became tickets — the ones that mattered most — aren’t in the average at all.

A team can drive MTTR down quarter after quarter and be getting less safe, if the reason the number is falling is that they’re only catching the easy, noisy, low-severity things fast while the quiet, patient intrusions sail past undetected. You can’t resolve what you never saw, so it never drags the average up. The metric rewards you for the blindness.

The denominator you’re not counting

Every detection metric has a hidden denominator: all the things that actually happened. MTTR, alert volume, closure rate — they all describe the slice you detected and say nothing about the slice you missed. And the slice you missed is precisely where a competent adversary operates, because their entire job is to not generate the alerts you’re good at closing quickly.

So the honest question in a SOC isn’t “how fast do we resolve?” It’s “what would we fail to see at all?” That question doesn’t have a comfortable dashboard number, which is exactly why it gets skipped.

Measure your coverage, not just your speed

The metrics worth reporting are the ones that describe what you can detect, not just what you did. Which attacker techniques do you have real coverage for, and which are you blind to? When you run a purple-team test and quietly execute a known technique, does anything fire — and how long until a human actually looks? That number, time-to-detect on a technique you injected on purpose, tells you far more about your risk than MTTR ever will, because it measures the gap between happening and noticing.

Coverage mapped against a framework like ATT&CK, honestly scored, will be uncomfortable. It will show large regions where you have no telemetry at all. Good. That discomfort is the actual state of your defense, which the resolution metrics were hiding behind a reassuring downward trend.

Keep MTTR, demote it

There’s nothing wrong with tracking resolution time for operational tuning — it’s a fine measure of process efficiency once something is in the queue. Just stop presenting it as a measure of safety. It answers “how quickly do we handle what we catch,” and the far more important question is “what are we not catching?” A SOC that can answer the second one is worth ten that can only optimize the first.