Your MTTD Looks Great. Your Post-Alert Gap Doesn't

MTTD metrics overlook the post-alert investigation gap where attackers actually operate. While detection engineering has improved, the real bottleneck is the 20-40 minutes analysts spend investigating each alert.

• •MTTD measures detection speed but ignores post-alert investigation time, the actual SOC bottleneck
• •Against 29-minute attack windows, attackers often complete breakout before investigation starts
• •AI-driven investigation compresses queue clearing, context assembly, and analysis from hours to minutes
• •Critical new metrics emerge: investigation coverage rate (should be 100% vs typical 5-15%), detection surface coverage, false positive feedback velocity, hunt-driven detection creation rate
• •SOC performance should shift from measuring detection speed to measuring actual security outcomes and improvement velocity