From hours to minutes. Every incident.

ManySignal measures MTTR as the time from first detection event to the last containment action for a case. Sub-metrics are tracked separately: mean time to detect (MTTD), mean time to triage (MTTT), mean time to investigate (MTTI), and mean time to respond (MTTR for the response phase only). Each is visible in the SOC metrics dashboard.

In customer baseline assessments, account compromise MTTR before ManySignal ranges from 3 to 8 hours (including overnight delays when incidents go undetected until morning). After ManySignal, the median MTTR for account compromise is 28 minutes: 30 seconds to detect, 24 seconds to triage, 4 minutes to investigate, and 22 minutes from on-call page to approved containment.

It genuinely reduces it. Manual investigation involves querying multiple systems, correlating events by hand, and writing up findings. ManySignal's Investigate agent runs these queries in parallel and produces a structured output the analyst reads — not reproduces. The actual investigation work is done by the agent; the analyst validates and decides.

ManySignal's pre-deployment assessment team runs a telemetry analysis against your historical incidents to establish a baseline MTTR per incident type. This uses your existing log data — no new tooling required. The baseline is delivered as part of the onboarding package and used to measure progress at 30, 60, and 90 days post-deployment.

The largest improvements are typically seen in: account compromise (3–8 hours → 28 minutes), phishing response (2–4 hours → 15 minutes), and lateral movement detection (6–24 hours → under 90 minutes). Cloud misconfiguration response improves from days to hours because ManySignal surfaces findings continuously, not in weekly scan batches.

For detections where pre-approved autonomous containment is configured, MTTR can be as low as 90 seconds: 30 seconds detection, 24 seconds triage, 45 seconds investigation, and near-instant autonomous action dispatch. This is achievable for high-confidence, well-defined threat types like known-bad IP connections, malware hash matches, and credential use from impossible travel locations. Analyst-reviewed cases add the approval decision time on top of that baseline.

Dwell time is directly correlated with breach impact. The IBM Cost of Data Breach report shows breaches identified and contained in under 200 days cost on average $1.2M less than those taking longer. ManySignal's MTTR reduction — from hours to minutes for most incident types — compresses the attacker's window for lateral movement, data access, and persistence establishment. Reduced dwell time directly reduces the scope of what an attacker can accomplish before containment.

Yes. ManySignal's SOC metrics report provides documented MTTR by incident type with timestamps — exactly the format cyber insurers request as evidence of detection and response capability. Several ManySignal customers have reported that documented MTTR improvement contributed to premium reductions or improved coverage terms at renewal. The report is exported as a PDF formatted for insurer submission.

Yes. PCI DSS Requirement 12.10 requires a documented incident response plan with defined response times. HIPAA requires timely breach identification and notification. ManySignal's MTTR reporting serves as documented evidence that incidents are being detected and responded to within defined windows. The evidence package includes timestamps from detection through containment, which satisfies the auditor's requirement for proof of timely response.