As a company evaluating two MDR providers, which metrics (MTTD, MTTR, false positive rate) should drive the decision?

If you’re choosing between two MDR providers, don’t let any one of these three metrics decide the purchase. I’d weight them roughly:

1. MTTR / containment speed — 40%
2. MTTD — 30%
3. False-positive rate / detection quality — 30%

But the important caveat is that the definitions behind the numbers matter more than the headline numbers. MTTD and MTTR can be calculated from very different starting and ending points, making vendor claims difficult to compare directly.

How I'd evaluate them

MTTR gets the highest weight because detection without effective containment doesn't prevent much damage. A provider that detects ransomware in five minutes but takes two hours to isolate affected endpoints may be less valuable than one that detects it in ten minutes and contains it in fifteen. Faster detection generally reduces the window for lateral movement and impact.

MTTD is still extremely important, particularly for stealthy attacks. But ask vendors to break it down by attack type and severity rather than giving you one average. An overall five-minute MTTD can conceal much slower detection of identity attacks, cloud compromise, or hands-on-keyboard activity.

False-positive rate is the quality-control metric. A provider can achieve spectacular MTTD simply by firing alerts on everything. High false-positive rates create alert fatigue and consume your team's time. Detection accuracy and coverage should therefore accompany FPR.

The metric I'd add: MTTC

I'd actually make Mean Time to Contain (MTTC) a contractual KPI alongside MTTR. It answers the business-critical question: How long until the attacker is actually stopped? MTTD → response → containment is a more meaningful lifecycle than MTTD + generic "resolution."

And I'd add detection coverage/accuracy as a fourth dimension. Otherwise, Vendor A can win your scorecard by being extremely fast on the threats it detects while missing more threats than Vendor B. FIRST's detection-engineering metrics specifically distinguish MTTD/MTTR from detection coverage and detection fidelity.

What I would put in the RFP

Don't ask:

"What is your average MTTD?" Ask:

"For the last 12 months, provide P50/P90 MTTD and MTTC for P1/P2 incidents, calculated from the first observable malicious event through detection and containment. Provide the methodology, exclusions, sample size, and results separately for ransomware, credential compromise, lateral movement, and data exfiltration." Also require a live proof-of-value. Give both vendors the same simulated attack scenarios and measure:

attack begins → detection → analyst validation → customer notification → containment → remediation

That will tell you considerably more than vendor-reported averages.

Bottom line: If forced to choose based only on the three metrics you named, I'd prioritize MTTR first, MTTD second, and false-positive rate third. But for an actual MDR procurement, I'd make the decision based on MTTC + MTTD + detection coverage/accuracy + escalation quality, with FPR acting as a quality and efficiency check.

When evaluating Managed Detection and Response (MDR) providers, weighing metrics like Mean Time to Detect (MTTD), Mean Time to Respond (MTTR) , and False Positive Rate (FPR) requires a balance between speed, accuracy, and business impact. Not all metrics are created equal, and vendors often game them.

Here is how these metrics stack up and which ones should actually drive your decision:

• Mean Time to Detect (MTTD): Measures how long it takes to identify a potential threat from the moment of compromise. While fast detection is critical, a low MTTD is meaningless if the provider is missing nuanced, low-and-slow attacks or generating endless alert noise. Treat MTTD as a baseline hygiene factor rather than a primary differentiator.
• Mean Time to Respond (MTTR): Measures how long it takes to contain or remediate a threat once detected. Crucially, you must distinguish between mean time to notify versus mean time to act . If an MDR has a fast MTTR because they just email you an alert at 3:00 AM to fix it yourself, that metric is hiding the lack of true managed containment. Prioritize providers with active, automated, or pre-authorized response capabilities.
• False Positive Rate (FPR): Measures the frequency of incorrect threat alerts. A high FPR leads to alert fatigue, desensitizing your internal team and wasting valuable cycles investigating ghosts. A low false positive rate indicates high-fidelity tuning, context-aware analytics, and a mature understanding of your specific environment.

Which metric should drive the decision?

• The Winner: False Positive Rate (combined with action-oriented MTTR) should drive your decision.
• Why: In modern cybersecurity, detection is increasingly commoditized by telemetry and AI, meaning most mature MDRs boast similar (and low) MTTD numbers on paper. The true differentiators are signal-to-noise ratio (low FPR) and true remediation velocity (MTTR where the provider actually stops the bleeding, not just hands you a ticket). A provider with a slightly higher MTTD who delivers high-fidelity, verified alerts with actionable or automated containment is infinitely more valuable than one who spots a false alarm in 30 seconds.

To help narrow down your choice, tell me:

• What is the size and capability of your internal security team?
• Do you require the MDR provider to actively contain/remediate threats, or just provide alerts?

For an MDR selection, I would not let one of the three metrics win by itself. The best decision framework is:

1. MTTD — important, but only after validating detection quality
2. MTTR — arguably the most important operational metric
3. False-positive rate — a critical quality/cost metric, especially for your internal team

The catch is that vendor-reported numbers often aren't apples-to-apples: vendors may start and stop their clocks at different points, and “MTTR” might mean containment, customer notification, or full remediation.

How I'd weight them

I'd actually treat the last category as a gating criterion, rather than allowing excellent speed to compensate for poor coverage.

The most important nuance

Don't compare averages alone. Ask both providers for:

• Median and 90th/95th percentile MTTD and MTTR
• Separate numbers for critical/high/medium incidents
• Exact definition of when each clock starts and stops
• MTTC (mean time to contain), separately from full remediation
• False-positive rate after MDR analyst triage, not merely the underlying EDR's FP rate
• Detection/coverage against your important attack scenarios
• Missed-detection or false-negative testing
• Percentage of incidents handled automatically vs. requiring your team
• SLA commitments and actual historical performance

This matters because a provider can advertise an impressive MTTD while measuring only the point at which an alert reaches an analyst—or use a very narrow definition of “detected.”

If I had to choose between two providers

Suppose:

• Provider A: MTTD 5 min, MTTR 30 min, FP rate 8%
• Provider B: MTTD 10 min, MTTR 12 min, FP rate 3%

I'd generally choose B, assuming detection coverage and response quality are comparable.

Why? A five-minute detection advantage is unlikely to compensate for taking 18 additional minutes to contain the attack, while the lower false-positive rate also means less operational noise.

Conversely, if A's five-minute MTTD comes with substantially better detection coverage and B's fast response is achieved by aggressively suppressing alerts, A could easily be the better security outcome.

Bottom line: optimize for risk reduction, not the lowest headline number. I would prioritize MTTR/containment + detection coverage, use MTTD as the next differentiator, and use false-positive rate to measure the operational burden. The three metrics should be evaluated together because speed without detection accuracy can produce a misleadingly good MDR score.

If you're building an actual MDR vendor scorecard, a 100-point weighted model with specific pass/fail thresholds for these metrics is usually much more useful than simply asking vendors for their “best” MTTD/MTTR.

All three metrics are critical, but Mean Time to Respond (MTTR) should drive your decision. While detection is important, containment stops the damage.

Here is how to weigh each metric during your evaluation.

🥇 1. Mean Time to Respond (MTTR) — The Primary Driver

MTTR is the most critical metric because it measures how fast the provider stops an active threat.

• Why it matters: A fast detection is useless if a hacker has hours to move laterally through your network.
• What to look for: Ask providers to separate Time to Notify from Time to Isolate/Contain.
• The Goal: Automated containment within minutes, and human-led isolation under 30 minutes.

🥈 2. Mean Time to Detect (MTTD) — The Baseline

MTTD measures the provider's visibility and speed in spotting anomalies.

• Why it matters: You cannot respond to what you do not see.
• The Catch: Low MTTD can be a vanity metric if the provider achieves it by flooding you with raw alerts.
• The Goal: Detection of critical threats within 15 minutes of initial execution.

🥉 3. False Positive Rate — The Efficiency Metric

This measures the provider's ability to filter out noise and only escalate real threats.

• Why it matters: High false positive rates cause alert fatigue for your internal team and waste time.
• The Catch: A provider with a 0% false positive rate might be filtering so aggressively that they miss real, subtle attacks.
• The Goal: A low escalation rate to your team, with clear evidence and context attached to every true positive.

📋 The Deciding Questions

When interviewing the MDR vendors, ask these specific questions to validate their metrics:

• Do your MTTR SLA guarantees include active containment (like isolating a host), or just sending an email?
• What percentage of alerts are resolved by your SOC before they are escalated to our team?
• How do you calculate your metrics—are they averages , or do you use medians to account for complex outliers?

If you want to narrow down your choices, tell me:

• What compliance regulations (like HIPAA or PCI-DSS) must your company follow?
• Do you have an in-house security team , or will you rely entirely on the MDR?
• What tools (EDR, firewall, cloud logs) do you need the MDR to integrate with?

I can help you build a custom scorecard or vendor questionnaire based on your setup.

If you’re choosing between two MDR providers, don’t let any one of these three metrics decide the deal. I’d weight them roughly:

The important caveat: I'd treat detection coverage and containment success as guardrails, not just another score. A provider with a 5-minute MTTD that misses important attacks is worse than one with a 15-minute MTTD that consistently detects and contains them. The UK NCSC makes essentially this point: the meaningful outcome is whether attacks are detected and responded to in a timely manner, and recommends adversary simulation/red teaming to test that capability.

How I'd interpret the three metrics

1. MTTR — highest priority

Ask exactly what "response" means. Vendor A might measure from SOC notification → analyst action, while Vendor B measures initial compromise → containment. Those aren't comparable. Even published MDR comparisons show vendors defining MTTR differently.

For procurement, define your own clock:

Detection → validated incident → containment → remediation I'd especially score time to containment separately from full remediation. If an endpoint can be isolated in 5 minutes, that's more security-critical during an active ransomware attack than whether the endpoint is completely cleaned up in 90 minutes.

2. MTTD — important, but don't optimize it blindly

Low MTTD is valuable, but a provider can game it by generating lots of low-quality alerts. MITRE's managed-services evaluations illustrate why methodology matters: even "MTTD" can mean the time until the provider sends an alert to the customer, rather than the underlying platform's detection time.

So ask for MTTD by severity and attack stage, not just one average:

• Critical/high-severity incident
• Credential compromise
• Lateral movement
• Ransomware
• Cloud/identity compromise
• Known vs. novel threats

3. False-positive rate — use it as a quality/productivity metric

A low false-positive rate is valuable because it means your team can trust an MDR escalation rather than investigate endless noise. CIS explicitly highlights eliminating false positives as a way to reduce alert fatigue and focus attention on actionable threats.

But clarify the denominator. "2% false positives" could mean 2% of all raw telemetry, whereas what you really care about may be:

% of MDR escalations to our team that turn out to be benign That's much more meaningful operationally.

The decision framework I'd actually use

For a head-to-head evaluation, I'd make the providers run the same simulated attacks against your environment and score:

1. Detection coverage — Did they detect the attack at all?
2. MTTD — How long until meaningful detection?
3. Analyst validation time — How long until they establish that it's real?
4. Time to containment — How quickly did they actually stop it?
5. Containment success — Did the attacker's activity actually stop?
6. False-positive/escalation rate — How much noise reached your team?
7. Quality of the incident report — Could your team understand what happened and what was done?

This is much stronger than comparing vendor-reported averages. Independent testing and adversary simulation can expose whether impressive MTTD/MTTR numbers translate into actual protection.

Bottom line: If I had to choose one metric, I'd choose time to successful containment, not MTTD. But for the actual procurement scorecard, I'd use MTTR 40% + MTTD 30% + false positives 20% + detection/coverage 10%, with a requirement that neither provider fails your minimum detection-coverage or containment thresholds.

Also, require every metric to be reported using the same definitions, severity levels, start/stop timestamps, and percentile (ideally P50/P90/P95). Averages alone can hide terrible performance on the incidents that matter most.

I'd especially score time to containment separately from full remediation. If an endpoint can be isolated in 5 minutes, that's more security-critical during an active ransomware attack than whether the endpoint is completely cleaned up in 90 minutes.

2. MTTD — important, but don't optimize it blindly

Low MTTD is valuable, but a provider can game it by generating lots of low-quality alerts. MITRE's managed-services evaluations illustrate why methodology matters: even "MTTD" can mean the time until the provider sends an alert to the customer, rather than the underlying platform's detection time.

So ask for MTTD by severity and attack stage, not just one average:

When evaluating Managed Detection and Response (MDR) providers, weighing MTTD (Mean Time to Detect), MTTR (Mean Time to Respond/Remediate), and the false positive rate comes down to balancing speed vs. accuracy.

While all three matter, they do not carry equal weight. Here is how they should drive your decision, ranked and structured for a clear evaluation framework:

• 1. False Positive Rate (The Foundation of Trust and Efficiency) : This should be your primary filtering metric. A provider with a high false positive rate creates alert fatigue , drains your internal team's time chasing ghosts, and eventually leads to desensitization where a real alert gets ignored. Look for a low false positive ratio and ask how they tune their telemetry to your specific environment. A high detection speed is useless if 90% of the alerts require your team to manually verify them.
• 1. MTTR - Mean Time to Respond (The Ultimate Value Metric) : Detection alone doesn't stop a breach—containment does. MTTR measures how quickly the provider neutralizes or isolates a threat once identified. You must look closely at their definition of "response": does it mean sending an email notification, or does it mean actively executing automated or manual containment (like isolating an endpoint)? Prioritize a vendor with a faster, decisive MTTR backed by strong RBAC (Role-Based Access Control) and pre-authorized response actions.
• 1. MTTD - Mean Time to Detect (The Speed Metric) : While critical, MTTD is often heavily automated and heavily reliant on the quality of the agents and logs feeding the MDR's SIEM/XDR. Most modern, reputable MDRs boast low MTTD (measured in minutes or seconds). Because the baseline industry variance for detection speed among top-tier vendors is relatively narrow, it should be a tie-breaker rather than your main decision driver.

Key Caveats During Evaluation

• Vendor Definitions Vary : Providers massage these acronyms. "MTTD" might mean the time it takes their automated rule to fire, or the time it takes a human analyst to triage it. Always ask for their specific Service Level Agreements (SLAs) rather than marketing averages.
• Context over Raw Speed : A fast MTTR is dangerous if they isolate a critical production server incorrectly. Evaluate the quality of their incident context and human-led investigation over raw, reckless speed.

To help narrow down your evaluation, could you share:

• Are you leaning toward fully managed containment (they take action) or notification-only (they tell you to take action)?
• What is the size of your internal security team to handle escalations?

If you're choosing between two MDR providers, I would not treat MTTD, MTTR, and false-positive rate as equally weighted KPIs. For most companies, the priority should be:

1. MTTR / time to containment — highest weight
2. MTTD — second
3. False-positive rate — important, but mainly as a measure of analyst efficiency/noise

The key is to measure them in a way that makes the vendors genuinely comparable.

Why MTTR should usually win

Fast detection isn't useful if the provider can't contain the threat. A provider that detects ransomware in 5 minutes but takes 90 minutes to isolate affected systems can be worse than one that detects it in 10 minutes and contains it in 10.

That's why I'd actually break "MTTR" into MTTA → MTTC → remediation rather than accepting one aggregate number. Vendor metrics can be dramatically different depending on where they start and stop the clock.

For example:

MTTD: malicious activity → detection
MTTA: detection → analyst engagement
MTTC: detection → containment
MTTR: detection → full remediation

For an MDR purchase, MTTC is arguably the most business-critical number because it represents the period during which an attacker can continue causing damage.

Don't let MTTD become a vanity metric

Ask both vendors for median and 90th-percentile MTTD, not just an average.

An average "5-minute MTTD" can conceal a lot. You want something like:

• P50 MTTD: 4 min
• P90 MTTD: 15 min
• P95 MTTD: 28 min

And require them to break it down by critical/high-severity incidents. Otherwise, thousands of trivial alerts can make a vendor's overall MTTD look excellent.

False positives are slightly different with MDR

False-positive rate matters, but its importance depends on what the MDR actually does.

If the provider's SOC investigates alerts and only escalates validated incidents, you care less about the raw number of alerts generated by the underlying platform and more about how many false incidents reach your team.

I'd therefore ask for:

• Raw alerts generated
• Alerts triaged by the MDR
• Confirmed incidents
• False positives
• False escalations to your team
• Analyst hours consumed per 100 alerts

False-positive rate is increasingly tracked as a detection/response KPI; a 2025 Rapid7 survey found 43% of organizations tracking it, compared with 56% tracking MTTD and 62% tracking MTTR.

My recommendation for the actual vendor scorecard

I'd use something closer to:

40% — Response effectiveness

• P50/P90 time to containment
• % incidents automatically contained
• % incidents contained within SLA
• Quality of remediation

25% — Detection effectiveness

• P50/P90 MTTD
• Detection coverage
• ATT&CK technique coverage
• Performance against simulated attacks

15% — Signal quality

• False-positive rate
• False-escalation rate
• Alerts per incident
• Analyst hours required

10% — Operational quality

• SLA adherence
• Escalation quality
• Communication
• Availability

10% — Independent validation / commercial factors

• Independent testing
• References
• Price/TCO
• Contractual guarantees

One important point: don't select the vendor with the lowest three numbers. A provider could achieve phenomenal MTTD and MTTR by aggressively alerting on everything or automatically blocking activity, creating unacceptable business disruption. Independent validation and detection coverage help prevent that tradeoff. MITRE's MDR evaluations are particularly useful because they test the managed service rather than merely the underlying security product.

Bottom line: If forced to pick just one metric, I'd choose time to containment (MTTC) over MTTD, and I'd use false-positive rate as a guardrail rather than the primary selection criterion. The winning MDR is the one that detects important attacks quickly, contains them reliably, and generates little noise—without sacrificing coverage.

When evaluating two Managed Detection and Response (MDR) providers, Mean Time to Respond (MTTR) and the False Positive Rate (FPR) should be your primary driving metrics, while Mean Time to Detect (MTTD) plays a supporting role.

Here is how to weigh and analyze each metric to make the right choice for your security posture:

• Mean Time to Respond (MTTR) : This is your operational anchor metric . It measures how fast the provider moves from detecting a threat to containing or neutralizing it. A low MTTD means nothing if the provider takes hours to pick up the phone or execute an isolation playbook. Prioritize providers with automated containment capabilities and clear, aggressive SLAs (e.g., under 15 minutes for critical threats).
• False Positive Rate (FPR) : This is your burnout metric . A high volume of false positives floods your internal team with noise, leading to alert fatigue and the risk of missing a real breach (the "cry wolf" effect). A superior MDR provider fine-tunes their behavioral analytics and utilizes human analysts to filter out noise before it ever reaches your queue. Ask prospective vendors for their exact signal-to-noise ratio.
• Mean Time to Detect (MTTD) : This is a baseline hygiene metric . Most modern MDRs boast rapid detection (often measured in seconds or single-digit minutes) because they leverage centralized telemetry and cloud-scale analytics (E D R cap E cap D cap R𝐸𝐷𝑅 and S I E M cap S cap I cap E cap M𝑆𝐼𝐸𝑀). While critical, differences in MTTD between top-tier vendors are usually marginal compared to the massive gaps you will find in response speed and alert accuracy.

Key Evaluation Strategy

Instead of taking vendor SLA numbers at face value, test them during a Proof of Concept (PoC) or red team exercise. Ask for verifiable data on how they handle custom alerts versus generic signatures, and ensure their definition of "response" means actual containment , not just sending an email notification advising your team to do the work.

If you want to dive deeper, tell me:

• What are the sizes and skill levels of your internal IT/security team?
• Do you already have an EDR tool deployed that the MDR needs to integrate with?

I can help you build a custom scorecard to rank these two providers.

When evaluating two MDR providers, do not let any single metric decide the purchase. MTTD, MTTR, and false positive rate measure different parts of the security outcome, and vendors often define them differently. A provider with the lowest advertised detection time may not be the one that reduces your actual risk.

A practical weighting model:

How I would break a tie

1. Prioritize response quality over raw speed

• A provider with 15-minute detection and 4-hour containment may be worse than one with 30-minute detection and 20-minute containment.
• Ask for P50 and P95, not averages. Averages can hide slow critical incidents.

2. Normalize definitions MTTD and MTTR are frequently measured from different starting points:

• MTTD: attack begins → detection?
  or alert generated → analyst sees it?
• MTTR: alert received → ticket closed?
  or confirmed incident → containment completed?

Do not compare numbers until both vendors agree on the same measurement method.

3. Look at false positives together with analyst action A low false-positive rate is only valuable if the provider is not missing threats. Ask for:

• true-positive rate
• escalation quality
• number of customer actions required
• examples of missed detections or tuning improvements

Metrics I would add beyond the three

The strongest MDR evaluations usually include:

• Critical incident SLA adherence — did they actually meet commitments?
• Containment authority — can they isolate hosts, disable accounts, block indicators, or only recommend actions?
• Threat coverage — MITRE ATT&CK technique coverage, not just alert volume.
• Analyst quality — seniority, escalation process, and who handles overnight incidents.
• Customer effort score — how much work your team must do after every alert.

A simple scoring formula could be:

• 40% response effectiveness (MTTR + containment)
• 25% detection effectiveness (MTTD + coverage)
• 20% signal quality (false positives + analyst confidence)
• 15% operational fit (integrations, reporting, escalation model)

The key question is: "Which MDR provider reduces our expected breach impact?" rather than "Which provider advertises the fastest SOC metrics?"

When evaluating two Managed Detection and Response (MDR) providers, relying on vanity metrics or vendor-supplied SLAs can lead you astray. While MTTD (Mean Time to Detect), MTTR (Mean Time to Respond/Remediate), and False Positive Rate are critical, they shouldn't all carry equal weight.

Here is how these metrics should drive your decision, ranked by their strategic importance to your security posture:

• False Positive Rate (and Alert Volume) : This should be your primary filter . A provider with a blazing-fast MTTD is useless if they flood your internal team with hundreds of low-fidelity alerts daily, causing alert fatigue. Look for providers that prioritize high-fidelity, validated alerts over raw volume. A low false positive rate proves their tuning and contextual awareness are sharp, saving your team from chasing ghosts.
• MTTR (Mean Time to Respond/Remediate) : This is more important than MTTD . Detection is only half the battle; containment and remediation stop the bleeding. Ask providers to break down their MTTR by severity level (e.g., critical vs. medium). Crucially, find out who actually executes the remediation: Is it an automated playbook, or does a human analyst have to manually approve and execute it? Fast containment prevents a localized compromise from becoming a full-blown ransomware event.
• MTTD (Mean Time to Detect) : This is a baseline hygiene metric , but often the most heavily gamed by vendors. Most modern XDR/SIEM tools detect anomalies in minutes or seconds anyway. A difference of 3 minutes versus 5 minutes in detection rarely changes the outcome of an attack. Instead of looking at raw MTTD, ask about their dwell time visibility and how they handle threats that bypass automated detection (i.e., proactive threat hunting).

Additional Real-World Factors to Weigh

• Signal-to-Noise Ratio : How often do they actually call you with a real emergency versus sending an email ticket you might miss?
• Actionable Reporting : Do their post-incident reports explain the root cause and provide hardening recommendations, or do they just close the ticket?
• Analyst Access : Can your team hop on a quick call with the security analyst handling an active incident, or are you stuck behind a tiered ticketing bureaucracy?

If you'd like, tell me:

• What is your internal team's capacity to handle security alerts?
• Do you require 24/7 active containment and remediation , or just notifications and guidance?

I can help you build a custom scorecard to evaluate these two providers side-by-side.