MTTD

A detection-speed metric that complements MTTR. Faster MTTD usually shrinks customer impact even before restore starts.

MTTD = sum of (start → detect) times ÷ number of incidents.

Tip: Keep “Total Detect Time” and “Incidents” on the same basis (period, units, and population) before calculating MTTD.

Cluster: DevOps hub · Deployment frequency · Software Testing hub · Percentage guide

MTTD averages how long it takes to detect incidents from start until acknowledgment or alert fire.

Enter total detection time across incidents and the incident count.

Sum of start→detect durations
Number of incidents in the sample

MTTD

Understanding MTTD

How we calculate. MTTD = sum of (start → detect) times ÷ number of incidents. The form uses the same arithmetic as the worked examples on this page. See our methodology and accuracy policy.

Real-world scenario: A typical MTTD case uses total detect time 180 and incidents 12. Enter the same figures below to reproduce the worked path.

What is MTTD?

A detection-speed metric that complements MTTR. Faster MTTD usually shrinks customer impact even before restore starts.

  • Start clock = incident begin per policy
  • End clock = detect/ack/alert
  • Same unit for total time (minutes/hours)

The Formula

Mean Time to Detect
MTTD = Total detect time ÷ Incidents

Worked Example

Scenario: Total 180 minutes to detect across 12 incidents.
Step 1: 180 ÷ 12 = 15 minutes
Answer: MTTD is 15 minutes.

Common Use Cases

  • Observability reviews: alert coverage
  • On-call quality: silent failure risk
  • SRE scorecards: detect vs restore

Pro Tips

  • Exclude synthetic-only noise if policy says so
  • Segment by severity
  • Pair with MTTR and MTBF

Limitations: MTTD results are educational DevOps/SRE/FinOps planning aids—not SLAs, billing guarantees, or operational policy. Confirm definitions with your platform and finance teams.

FAQ

Is MTTD part of DORA?

No—DORA’s restore metric is MTTR. MTTD is a common SRE companion for detection latency.

What if incidents is 0?

MTTD is undefined—enter at least one incident.

Authoritative References

For SRE and FinOps definitions, consult: