MTTR Is Useful but Dangerous When It's Your Only Assessment Signal

MTTR has become the default scorecard for security operations performance. It shows up in board decks, vendor ROI claims, and SOC leadership reviews with the kind of quiet authority that suggests it has everything covered.

But it actually doesn't.

MTTR is not a bad metric. It is an incomplete signal. The problem with incomplete metrics is not that they deliberately mislead, it is that they often look complete enough to stop people from asking better questions. And in security operations, the questions you don't ask are where risk compounds.

One Number. Many Incidents. One Problem.

By definition, MTTR is the average time to resolve, repair, or remediate incidents across a given period. That makes it genuinely useful for two things: tracking whether your SOC is broadly trending in the right direction over time, and giving leadership a single, readable headline for operational performance.

But averages are blunt instruments. They compress widely different incident types, investigation depths, and response efforts into a single figure while hiding the distribution underneath.

In most fields, averages work well enough when the underlying data is reasonably uniform. Incident response is not one of those fields. A SOC queue can contain both five-minute phishing triage and multi-week ransomware investigations. These are fundamentally different types of work. That distinction becomes harder to manage when the median time to fully patch critical vulnerabilities has now increased to 43 days from 32 days.^[1]

The Operational Gap No Average Can Bridge

A phishing alert typically involves checking a suspicious email, validating a link against threat intelligence, confirming whether the user clicked, and closing or escalating. An experienced analyst can work through this in under 20 minutes with the right tooling.

A ransomware investigation involves confirming the initial access vector, mapping lateral movement across the environment, identifying every affected endpoint and compromised account, assessing whether data was exfiltrated before or during encryption, coordinating containment across IT, security, legal, and compliance teams, and building a remediation plan that may span hundreds of systems and take weeks to execute fully.

These two investigations differ across nearly every operational dimension: data sources, stakeholder involvement, decision complexity, containment urgency, and business impact.

The same fundamental gap exists between OAuth abuse and endpoint malware. Between privilege escalation and an insider threat. Between a known malware signature match and an active lateral movement case.

Each incident type follows a different path, carries different risk, and demands a different standard of investigation.

When all of that gets collapsed into a single average, you are not measuring performance clearly. You are obscuring where risk actually exists.

When High Volume Hides High Risk

Imagine your SOC alert queue looks like this:

80% low-complexity triage cases: phishing alerts, known malware signatures, policy violations, routine credential anomalies. These close in minutes to a few hours.
20% high-complexity investigations: ransomware, lateral movement, OAuth abuse, privilege escalation, insider threats, data exfiltration. These take days, sometimes weeks.

Your aggregated MTTR will look healthy. The high-volume, fast-closing majority dominates the mean. The dashboard stays green. The quarterly review goes smoothly.

And somewhere in the long tail, your most critical investigations are slow, under-resourced, and invisible in the metric you are reporting to leadership.

Distributed systems engineering has long recognised that averages hide long-tail problems, and SOC teams face the same issue when high-volume triage work obscures slow, high-impact investigations inside a single MTTR metric.^[2]

What This Creates in Practice

When MTTR functions as the primary performance KPI, three problems emerge quietly, over time:

False operational confidence. A healthy MTTR can make response operations appear effective while critical investigations remain stalled for days or weeks. Leadership sees a green dashboard while high-severity investigations continue accumulating risk in the background.
Misleading ROI narratives. An improvement in MTTR often gets interpreted as proof that a new tool or process delivered value. But if the improvement comes entirely from faster triage of low-complexity alerts, the organisation may be improving triage speed without materially improving response effectiveness for high-risk investigations.
Weak risk measurement. Security investments are supposed to reduce exposure. But when metrics fail to show where investigations slow down, teams struggle to connect operational improvements to actual risk reduction, especially when the average breach lifecycle still takes 241 days to identify and contain.^[3]

The Real Issue

The problem is not that organisations don't measure enough.

The problem is that they measure response speed without understanding where investigations actually slow down: missing context, delayed decisions, manual correlation work, and inefficient handoffs.

Speed tells you an outcome. Friction tells you a cause. MTTR, on its own, only gives you the former.

When an investigation runs long, the relevant question is not just "how do we close it faster?"

It is:

Where did the investigation slow down, and why?
Was critical context missing?
Were analyst handoffs creating rework?
Was the investigation spread across five disconnected tools requiring manual correlation?
Were approvals adding hours to a decision that needed to be made in minutes?

Those are the questions that lead to meaningful operational improvement. MTTR, as a single number, has no mechanism to surface any of them.

What Comes Next

In Part 2, we’ll break down where SOC time actually goes after an alert fires, including the investigation phases that disappear inside a single average but become obvious when you examine the anatomy of a real incident.

References

Loved this insight?

Share it with your network and help secure the digital world.