Mean time to detect (MTTD) is a metric, one of the timing numbers a thorough DDoS test is built to measure. It is the average elapsed time from the first attack packet to the moment monitoring and detection systems recognize that an attack is under way. MTTD is the front half of total time-to-mitigation: nothing can be filtered until the attack is seen, so detection latency sets the floor on how fast any mitigation, automatic or human, can begin to engage.
Why it matters in DDoS testing
Detection that fires in seconds and detection that fires in minutes produce very different outage durations from the identical attack. MTTD is what turns "we have monitoring" into a measured number rather than an assumption. A test launches a controlled attack and records exactly when alarms, anomaly baselines, or operators first register it, exposing blind spots where a slow-ramp or low-rate flood slips under the detection threshold entirely.
How detection latency factors into overall resilience is examined in DDoS resilience testing.