Mean time to detect only includes incidents or flaws you eventually found. Anything never detected is absent from the average, so a good looking number can sit beside serious blind spots. Pair detection time with coverage, tests of your detection, and the share of findings discovered by outsiders.
The survivorship problem
Imagine measuring how long it takes to spot problems. You can only time the ones you spotted. The ones still hidden have no timestamp, so they do not appear. The average describes the visible subset, and an improving average can reflect better luck.
This holds for vulnerabilities too. Time from publication to detection in your estate looks good if your inventory is accurate for the assets you know, and says nothing about assets you do not know.
Averages and tails
Detection times are skewed. Many are quick, a few are very long. A mean can be pulled by one old discovery, or can look fine while a long tail goes unseen. Use the median and a high percentile, and show the oldest undiscovered-until-late case, found in review.
Add measures of the unseen
| Measure | What it reveals |
|---|---|
| Share found by external parties | Gaps your own detection missed |
| Detection test results | Whether a planted case is caught, and how fast |
| Asset inventory completeness | How much you cannot see |
| Scan coverage by asset type | Where nothing is checked |
| Late discovery review | Why old issues were found late |
The first is blunt and useful: if outsiders such as customers, researchers or partners tell you about issues more often than your own monitoring, your detection is weaker than the average suggests.
Steps to improve the metric
- Define start and end precisely: start at the earliest known occurrence or exposure, not at the ticket.
- Report median and a high percentile, not just a mean.
- Record how each item was discovered: internal tooling, review, customer, researcher.
- Run periodic detection exercises with planted scenarios and time the response.
- Track inventory completeness, as detection cannot exceed what you know exists.
- Review every late discovery for the missing signal.
Be careful with targets
If a team is rewarded for a low detection time, it may redefine the start to the ticket creation date, which shortens the number without changing anything. This is the usual Goodhart pattern. Fix definitions, publish them and audit samples.
What to say in a report
Say what was measured, what was not, and how you will find out what you are missing. "Our median detection time is X among incidents we found" is more honest than a bare average, and invites the right follow up questions.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Why can detection time improve while risk rises?
It only covers what you found. New blind spots add undetected items that never enter the average.
What is the simplest way to see blind spots?
Track how many issues were first reported by outsiders rather than your own tooling.
Sources
Last reviewed: 19 October 2026.
