Measured in Minutes, Lost in Months: The Dangerous Fiction of Fast Breach Detection

There is a number that appears in nearly every security program review, every board presentation, and every vendor pitch deck: mean time to detect. MTTD, as it is commonly abbreviated, has become the metric by which security teams justify investment, demonstrate maturity, and reassure leadership that the organization is not blind to threats moving through its environment. The problem is that for a significant percentage of US organizations, that number is wrong — not slightly off, but wrong in ways that fundamentally misrepresent the risk landscape defenders are actually navigating.

Forensic evidence collected following confirmed intrusions tells a story that diverges sharply from internally reported detection timelines. Understanding why that gap exists, and what threat actors do with the time it creates, is among the more urgent problems in enterprise security today.

The Benchmark and the Reality

Industry surveys regularly find that security teams believe they can detect a breach within hours. Some organizations report even shorter windows, citing automated detection capabilities and mature SIEM configurations as evidence that their monitoring posture is sound. These figures are not fabricated — they reflect genuine confidence in the tools and processes that teams have built.

However, third-party incident response data consistently paints a different picture. Post-breach forensic analysis has repeatedly documented adversary dwell times — the period between initial compromise and confirmed detection — measured not in hours but in weeks, and in many cases months. The Mandiant M-Trends report, among other industry benchmarks, has tracked global median dwell times that, while improving over recent years, still reflect detection failures that self-reported metrics would not predict. For US organizations operating in sectors such as healthcare, manufacturing, and critical infrastructure, those timelines can extend considerably further.

The divergence between reported MTTD and forensically established dwell time is not primarily a technical failure. It is a measurement failure — and that distinction matters enormously for how defenders allocate attention and resources.

Why Internal Metrics Lie

Most internally generated detection metrics are calculated from the moment a security alert is triaged and confirmed, not from the moment an adversary first established a foothold. This distinction is subtle but consequential. If a threat actor compromised a credential in January, moved laterally through February, and was not detected until a SIEM alert fired in March, the organization's MTTD might record a detection time of four hours — the time between the alert and the confirmed incident. The two months of undetected access preceding that alert do not factor into the calculation at all.

This creates a systematic optimism bias embedded directly into the metrics that security leadership uses to evaluate program effectiveness. Teams are not lying when they report fast detection times. They are measuring a different thing than what actually matters: the total window during which an adversary operated without interference.

Additionally, many organizations measure detection performance against the subset of incidents they know about. Breaches that are discovered months later by a third party, or that surface only after data appears on criminal marketplaces, are often excluded from internal reporting cycles — which further skews the perceived detection baseline in a favorable direction.

What Threat Actors Know That Defenders Don't

Sophisticated threat actors — particularly ransomware affiliates, state-sponsored groups, and financially motivated intrusion operators active in the US market — operate with a working assumption that they have considerably more time inside a target environment than the target's security team believes. This is not speculation. Operator tradecraft manuals recovered from disrupted ransomware groups and post-incident forensic reconstructions both demonstrate deliberate patience as a core tactical element.

During the dwell period, adversaries accomplish several objectives that directly amplify the eventual impact of an attack. They enumerate domain structure and identify high-value targets. They harvest credentials from memory and from credential stores, building redundant access paths that survive initial detection and remediation. They identify and access backup infrastructure — a step that has become nearly universal in ransomware operations targeting mid-market and enterprise organizations. And they exfiltrate data selectively, often using legitimate cloud services or encrypted channels that blend with normal traffic patterns.

By the time a defender's detection capability finally surfaces the intrusion, the adversary has frequently completed the most damaging phases of their operation. The detection event itself may represent not an early warning but a confirmation that the attack has already succeeded.

The Tooling Confidence Problem

A significant contributor to the confidence gap is the tendency to conflate tool deployment with detection capability. An organization that has deployed an EDR platform, a SIEM, a network detection and response solution, and a cloud security posture management tool has invested meaningfully in visibility infrastructure. That investment is necessary. It is not sufficient.

Tools generate alerts. Alerts require context, prioritization, and human judgment to become actionable intelligence. In environments where alert volumes exceed analyst capacity — a condition that describes the majority of US enterprise security operations — high-fidelity signals are routinely buried beneath lower-priority noise. Threat actors who understand detection tooling, and many do, deliberately operate in the behavioral space between normal activity and threshold-based alert triggers. They move slowly. They use signed binaries. They abuse legitimate administrative protocols. They generate the kind of low-and-slow activity that automated detection systems are least equipped to surface quickly.

The confidence derived from tool deployment is real, but it frequently outpaces the operational maturity required to extract meaningful detection value from those tools under realistic adversary conditions.

Recalibrating the Measurement Framework

Closing the confidence gap requires a willingness to measure detection performance honestly, which means accepting that internally reported MTTD figures may not reflect actual adversary dwell time. Several practices help organizations develop a more accurate picture.

Purple team exercises, in which red team operators simulate adversary behavior against production detection controls, provide direct evidence of how long realistic intrusion activity goes undetected. Unlike traditional penetration tests, purple team engagements are specifically designed to surface detection blind spots rather than simply demonstrate that compromise is achievable.

Threat hunting programs that operate independently of alert queues — proactively searching for indicators of compromise and anomalous behavior patterns rather than waiting for automated detection to fire — provide a meaningful corrective to alert-dependent MTTD calculations. When hunt operations surface activity that existing controls missed, the resulting timeline becomes part of the organization's honest detection record.

Finally, organizations that participate in information sharing arrangements, such as sector-specific ISACs, benefit from threat intelligence that includes realistic dwell time data from confirmed incidents in comparable environments. That context is often more instructive than any internally generated benchmark.

The Metric Worth Keeping Honest

MTTD will remain a useful management metric as long as it is calculated against the full timeline of adversary access rather than the narrower window between alert and confirmation. Security leaders who present detection performance to boards and executive teams have both a professional and strategic obligation to ensure the numbers they report reflect operational reality.

The organizations that close the confidence gap are not necessarily those with the most sophisticated tooling. They are the ones willing to interrogate their own assumptions — and to treat honest measurement as a defensive capability in its own right.