For years, cybersecurity has become increasingly measurable. Security leaders can often tell you how long it takes to detect an intrusion, contain an attack and restore normal operation. Those figures have given boards a straightforward way to judge progress, offering reassurance that investment in security is delivering real improvements.
Metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) have earned their place at the table. They both provide a clear picture of how effectively security teams perform when something goes wrong and have helped drive better incident response across the industry.
The problem is not that these metrics are wrong. They were designed for a different era, when technology changed more slowly, attack methods evolved over longer timescales and AI wasn't yet part of the equation.
Today's businesses are introducing new technologies at an extraordinary pace. AI is becoming embedded across organizations, cloud environments continue to expand and businesses are more interconnected than ever before. At the same time, attackers are constantly adapting their own techniques, taking advantage of new tactics and tools almost as quickly as they emerge.
CISO’s and boards need to dynamically review the changing threat landscape and risk posture and ask themselves whether the metrics relied on for years still tell us everything we need to know.
Mind the gap
Every business wants to detect attacks sooner, contain them faster and recover with minimal disruption. That’s why MTTD and MTTR remain valuable operational measures. They tell us how effectively a security team performed once an incident was underway.
What they don't tell us is whether the business is becoming better prepared for what comes next, more resilient, more agile in recovery. That matters because cyber risk continues to evolve long after an incident has been contained.
The UK Government's Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses experienced a cyber breach or attack during the previous year.
This reinforces how security teams are operating in an environment where incidents are a regular reality, whether it's in their own environment, or that of one of their supply chain. Responding well is important, but resilience is shaped by everything that happens before incidents.
A business may recover quickly from an attack but still take months to review its security policies, reassess supplier risk or strengthen controls in response to what it has learned. By the time those changes are made, the threat landscape will have moved on.
Traditional metrics tell us how quickly a business responds to an incident. They don't tell us how quickly it learns from one, or how quickly it adapts.
Closing the gap
If we're going to close that gap of preparedness, our metrics need to evolve as well. Resilience is no longer defined solely by how well a business responds to isolated incidents, but by how quickly it keeps pace with continuous change.
I believe organizations should start thinking about another benchmark alongside the ones we already know: Mean Time to Adapt (MTTA).
MTTA considers how long it takes to recognize a meaningful change in the threat landscape and turn that knowledge into action.
Sometimes that action will be technical. It could mean updating the rules security tools used to detect emerging attack techniques. Or it might involve tightening access to critical systems after a serious vulnerability is discovered. It may also be a proactive lessons learned view of an attack on another organization or sector to understand how vulnerable the organization would be.
In other cases, the response will be organizational rather than technical. It may involve reviewing governance, changing how cyber risk is reported to the board or refreshing employee awareness programs to reflect the latest tactics being used by attackers.
Either way, resilience depends on both. The strongest security programs combine technical improvements with organizational change, ensuring businesses can recognize change and act on it quickly.
That’s why closing this gap is not only a technology challenge. It relies on decision-making, leadership and a willingness to keep questioning whether existing assumptions still hold true. Businesses that adapt well rarely assume their current security program is finished. They expect it to evolve because the environment around them is evolving too.
That thinking is increasingly reflected across the wider industry. For example, the National Cyber Security Centre's Cyber Assessment Framework places governance, risk management and continual improvement at the heart of cyber resilience. It recognizes that security is an ongoing organizational capability, not a one-time achievement.
A different conversation in the boardroom
If preparedness and adaptation becomes a more meaningful measure of resilience, it will change the conversations taking place in the boardroom.
Most directors already receive regular updates covering incidents, phishing activity and response times. Those reports remain important, but they won’t always show how well the business is responding to change itself.
The discussion must now move beyond operational reporting and give greater prominence to MTTA. This would give boards a way to measure how quickly an organization responds to change, rather than simply how efficiently it handles incidents.
In practice, that means asking a different set of questions. How quickly does the business reassess risk when a significant new threat emerges? How long does it take for new intelligence to shape security policies? Have lessons from recent attacks fundamentally changed the way the organization operates, or have they simply been recorded and filed away?
By measuring adaptation, rather than response alone, organizations can answer these questions with greater confidence and build a broader picture of resilience.
And this isn't solely a question for security teams. It depends on leadership, governance and how prepared the wider business is to make decisions as risks continue to evolve.
Measuring what matters
MTTD and MTTR will remain valuable measures of operational performance. But if organizations want to understand how resilient they really are, they also need to know how quickly they adapt.
MTTA fills that gap. It won't replace today's cyber metrics, but it will enhance them by measuring a capability that is becoming increasingly important as technology, AI and cyber threats continue to evolve.
It’s now MTTA time to shine.
We've featured the best endpoint protection software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
