What is the purpose of MTTR as a cybersecurity metric?

• A. Mean time to track regulatory changes.
• B. Mean time to build a new feature.
• C. Mean time to respond to user inquiries.
• D. Mean time to detect/resolve a security issue.

Answer: (D)

MTTR in cybersecurity measures how long it takes to go from the moment a security issue arises (or is detected) to the moment it is resolved and normal operations are restored. This captures the speed of your incident response and remediation, which is crucial because shorter dwell time means less potential damage, reduced exposure, and less downtime. MTTR spotlights how well the organization handles the entire incident lifecycle—detection and alerting, triage, containment, eradication, and recovery. A low MTTR often reflects effective monitoring, clear playbooks, automation, and coordinated teamwork. The other described activities do not reflect incident detection and remediation speed, so they aren’t what MTTR measures.