All DDoS Definitions
DDoS Testing Definition

Time-to-Mitigation (TTM)

Time-to-mitigation (TTM) measures the gap between the first malicious packet reaching the edge and the moment clean traffic flows again with scrubbing fully engaged. Under attack that gap is simply the duration of the outage, which is why a DDoS test reports it beside time-to-recovery rather than on its own. It is one number that hides several, and the value of measuring it is in pulling those apart.

Time-to-mitigation: the interval the origin stays exposed Origin exposed for the whole interval = TTM Detection Decision Propagation Scrubbing warms Clean thresholds trip divert or not BGP convergence / DNS TTL expiry scrubbing path fills first malicious packet clean traffic resumes A test measures TTM under a controlled attack onset, then breaks it down stage by stage. The slowest contributor (a long DNS TTL, a manual approval step) dominates the whole number. BlackNeuron™
Diagram of time-to-mitigation: detection, decision, propagation, and scrubbing warm-up stages during which the origin stays exposed

The stages hidden inside one number

TTM is a sum, not a single event. It runs from attack onset through four stages that each add their own delay.

Detection comes first. Nothing can be filtered until the attack is seen, so mean time to detect sets the floor for everything that follows; a slow-ramp flood that stays under an anomaly threshold can stretch this stage for minutes.

Then the decision to divert, which may be an automatic rule or a human approving a change under pressure. After that comes propagation: a BGP announcement has to converge across the path, or a DNS record has to wait out its TTL, before traffic actually starts arriving at the scrubbing tier. Finally the scrubbing path itself warms up, learning the traffic and bringing filters online.

Add those together and you have the interval the origin spends exposed. A stack can be excellent at one stage and ruinous at another, so the total tells you little until it is broken down.

Why it matters under attack

TTM is the number that separates a stack which detects attacks from one which survives them. Two systems can carry the identical monitoring and the identical scrubbing capacity and still produce wildly different outages, because a long DNS TTL or a manual approval step quietly dominates the sum.

The choice of posture moves it directly. An on-demand path only diverts when an attack starts, so it always carries a cutover delay; an always-on path through a scrubbing center drives TTM toward zero at a steady-state latency and cost. Neither is free, and which trade is right is a decision you make with the measured number in hand, not an assumption. TTM measures how fast filtering begins; time-to-recovery measures how long the system then needs to settle, and the two are not the same tail.

Time-to-mitigation: the width of the exposure window normal service level legitimate traffic served time from the first malicious packet attack begins, detection still counting origin exposed, scrubbing not engaged diversion propagates, scrubbing warms up clean traffic resumes time-to-mitigation is the whole span from onset to clean traffic resuming BlackNeuron™
Animated time-to-mitigation: legitimate traffic dips as the attack begins and the origin sits exposed through detection, diversion and scrubbing warm-up, then recovers once clean traffic resumes, and the width of the dip is the metric

What a DDoS test measures

A test drives a controlled attack onset and clocks TTM directly, then decomposes it stage by stage so the slowest contributor is visible rather than averaged away. The output that matters is not the headline total but the breakdown: which stage owns most of the exposure window, because that is the one worth spending on.

What a slow stage actually costs the defender, and how the interval rolls up into a resilience posture, is worked through in DDoS resilience testing.