Detection-to-response time is the elapsed time between identifying a suspicious event and executing a defensive action such as isolating a host, blocking an account, or launching an incident workflow. In security operations, this interval includes alert review, triage, approval, and containment steps. A shorter detection-to-response time reduces attacker dwell time and can stop credential theft, lateral movement, or data exfiltration before they spread.
It matters because fast detection alone does not stop attacks; the response path must be equally fast. Automated tools may flag malware or anomalous logins, but slow handoffs, unclear ownership, or manual approvals can erase the benefit. Defenders measure this timing to find bottlenecks, improve playbooks, and tune SIEM, SOAR, and incident-response processes. Attackers gain whenever this gap is long, so shrinking it is a core defensive control.