IR Metrics and Program Measurement
The metrics that actually measure IR program effectiveness — MTTD, MTTR, dwell time, false positive rate — how to calculate them, what benchmarks mean, and how to present them to leadership without lying with statistics.
The CISO is presenting the IR program status to the board. The current dashboard shows: "1,240 incidents resolved this year, 98% within SLA." The board member who runs a risk committee asks: "How does that compare to last year, and how do we know if we're actually getting better?" The IR lead doesn't have last year's data in a comparable format. The SLA metric — 98% resolved within 72 hours — measures closing tickets, not stopping attackers. A ransomware incident that resulted in 200 encrypted hosts was "resolved within SLA" because the ticket was closed in 68 hours. The board member is right to ask the question. This chapter explains which metrics actually matter and how to calculate them.
Core IR Metrics
| Metric | Definition | Why it matters | How to calculate |
|---|---|---|---|
| MTTD (Mean Time to Detect) | Average time from attacker initial access to first detection alert | Measures how long attackers dwell before you see them — shorter = better detection coverage | For each incident: (detection time) − (estimated initial access time, from forensics). Average across all incidents in the period. |
| MTTR (Mean Time to Respond) | Average time from detection to containment of the incident | Measures response speed — shorter = faster attacker eviction once detected | For each incident: (containment confirmed time) − (alert fired time). Average across all incidents. |
| Dwell time | Time from initial access to eradication complete | The total time an attacker was in the environment — the real impact metric | For each incident: (eradication complete time) − (initial access time) |
| False positive rate | Percentage of alerts that did not represent real threats | Measures detection quality — too high wastes analyst time; too low suggests detection gaps | (False positive alerts / Total alerts) × 100. Track per rule/detection to identify noisy detections. |
| Alert-to-case escalation rate | Percentage of alerts that escalated to formal IR cases | Measures whether the alert volume at Tier 1 is appropriately calibrated | (Cases opened / Alerts triaged) × 100 |
| Re-compromise rate | Percentage of eradicated incidents that resulted in re-compromise within 90 days | Measures eradication quality — any re-compromise indicates a missed persistence mechanism or unclosed entry vector | (Re-compromised incidents / All eradicated incidents) × 100. Target: 0%. |
Industry Benchmarks (Mandiant M-Trends 2024)
IR Benchmark Reference Points (2024)
═══════════════════════════════════════════════════════════════════
Global median dwell time:
2023 M-Trends: 10 days (down from 16 days in 2022)
Internal detection median: 8 days
External notification median: 13 days
(External = customer, law enforcement, or other 3rd party notified you)
What "good" looks like for mature SOC programs:
MTTD target: < 24 hours for critical alerts (ransomware precursors)
< 4 hours for confirmed active exploitation
MTTR target: < 4 hours for host isolation after confirmed compromise
< 24 hours for full initial containment
False positive < 20% overall; < 5% for high-severity alerts
rate target:
Context:
These benchmarks represent large-scale external IR firm data.
A 2-person SOC at a 500-person company will have different
realistic targets than a 50-person SOC at an enterprise.
Set internal targets based on YOUR trend, not global median.
"Improving" matters more than "matching the benchmark."
Reporting to Leadership
Translating IR metrics into language leadership understands requires context, trend, and business framing.
| Technical metric | Leadership translation |
|---|---|
| MTTD decreased from 45 days to 9 days year-over-year | "We reduced the average time an attacker operates undetected in our environment from 6.5 weeks to 9 days. This limits the window in which they can steal data or cause damage." |
| MTTR decreased from 8 hours to 2 hours | "Once we detect an attacker, we now contain the threat in 2 hours on average, versus 8 hours last year. Faster containment limits the blast radius of each incident." |
| False positive rate dropped from 65% to 28% | "Our analysts now spend more time investigating real threats. We've improved detection quality so that nearly 3 out of 4 alerts are genuine — versus fewer than 1 in 3 last year." |
| Re-compromise rate: 2 of 18 eradicated incidents had re-compromise | "In 2 cases this year, the attacker returned after we thought we'd evicted them. Both cases revealed gaps in our eradication process that we've since addressed." |
Volume metrics — incidents resolved, tickets closed, SLA compliance percentage — measure activity, not outcomes. An IR program that resolves 2,000 alerts per year but misses every real intrusion is performing perfectly on volume metrics and catastrophically on security outcomes. The metrics that matter are outcome metrics: how long before we detected it, how quickly did we contain it, did the attacker get what they came for, and did we prevent them from coming back. These are harder to calculate (they require accurate initial-access timestamps, which requires good forensic capability) but they're the ones that tell you whether the program is actually working.
Q & A
Q: You can't calculate accurate MTTD because you often can't determine the initial access date with confidence. How do you handle this?
Document the uncertainty in the metric itself: "MTTD for incidents where initial access date was determined with high confidence: 14 days. MTTD for all incidents including estimated access dates: 21 days." The cases where you can't determine initial access are themselves a metric: they indicate gaps in forensic evidence that prevent accurate scoping. If 40% of your incidents have unknown initial access dates, that's a detection and logging coverage problem worth surfacing. Over time, as you improve logging retention (SIEM retention, EDR telemetry window), more incidents will have determinable initial access dates, and your MTTD calculation will become more accurate. Track the "percentage of incidents with known initial access date" as a secondary metric that shows improving forensic capability.