Your MTTD Looks Great. Your Post-Alert Gap Doesn’t

Anthropic restricted its Mythos Preview model last week after it autonomously found and exploited zero-day vulnerabilities in every major operating system and browser. Palo Alto Networks’ Wendi Whitmorewarned that similar capabilities are weeks or months from proliferation. CrowdStrike’s 2026 Global Threat Report puts average eCrime breakout time at 29 minutes. Mandiant’s M-Trends 2026 shows adversary hand-off times have collapsed to 22 seconds. 

Offense is getting faster. The question is where exactly defenders are slow — because it’s not where most SOC dashboards suggest.

Detection tooling has gotten materially better. EDR, cloud security, email security, identity, and SIEM platforms ship with built-in detection logic that pushes MTTD close to zero for known techniques. That’s real progress, and it’s the result of years of investment in detection engineering across the industry. 

But when adversaries are operating on timelines measured in seconds and minutes, the question isn’t whether your detections fire fast enough. It’s what happens between the alert firing and someone actually picking it up.

The Post-Alert Gap

After the alert fires, the clock keeps running. An analyst has to see it, pick it up, assemble context from across the stack, investigate, make a determination, and initiate a response. In most SOC environments, that sequence is where the majority of the attacker’s operating window actually lives.

The analyst is mid-investigation on something else. The alert enters a queue. Context is spread across four or five tools. The investigation itself requires querying the SIEM, checking identity logs, pulling endpoint telemetry, andcorrelating timelines. For a thorough investigation — one that results in a defensible determination, not a gut-feel close — that’s 20 to 40 minutes of hands-on work, assuming the analyst starts immediately, which they rarely do.

Against a 29-minute breakout window, the investigation hasn’t started by the time the attacker has moved laterally. Against a 22-second hand-off, the alert might still be in the queue.

MTTD doesn’t capture any of this. It measures how quickly the detection fires, and on that front, the industry has made genuine progress. But that metric stops at the alert. It says nothing about how long the post-alert window actually was, how many alerts received a real investigation versus a quick skim, or how many were bulk-closed without meaningful analysis. MTTD reports on the part of the problem that the industry has already made real headway on. The downstream exposure — the post-alert investigation gap — isn’t reflected anywhere.

The queue disappears. Every alert is investigated as it arrives, regardless of severity or time of day. Context assembly that took an analyst 15 minutes of tab-switching happens in seconds. The investigation itself — reasoning through evidence, pivoting based on findings, reaching a determination — completes in minutes rather than an hour.

This is what we built Prophet AI to do. It investigates every alert with the depth and reasoning of a senior analyst, at machine speed: planning the investigation dynamically, querying the relevant data sources, and producing a transparent, evidence-backed conclusion. The post-alert gap doesn’t exist in this model because there is no queue and no wait time. For teams working toward this benchmark, we’ve published practical steps to compress investigation time below two minutes.

The same structural constraint applies to MDR. MDR analysts face the same post-alert bottleneck because they’re still bound by human investigation capacity. The shift from outsourced human investigation to AI investigation removes that ceiling entirely, changing what becomes measurable about your SOC’s actual performance.

The Metrics That Matter Now

Once the post-alert window collapses, the traditional speed metrics stop being the most informative indicators. MTTI of two minutes is meaningful in the first quarter you report it. After that, it’s table stakes. The question shifts from “how fast are we?” to “how much stronger is our security posture getting over time?”

Four metrics capture this:

1. Investigation coverage rate. What percentage of total alerts receive a full investigation consisting of a complete line of questioning with evidence? In a traditional SOC, this number is typically 5 to 15 percent. The rest get skimmed, bulk-closed, or ignored. In an AI-driven SOC, it should be 100 percent. This is the single most important metric for understanding whether your SOC is actually seeing what’s happening in your environment.
2. Detection surface coverage. MITRE ATT&CK technique coverage mapped against your detection library, with gaps identified and tracked over time. This means continuously mapping the detection surface, identifying techniques with weak or no coverage, and flagging single points of failure or scenarios where a single detection rule is the only thing between the organization and complete blindness to a technique. Detection engineering in an AI-driven SOC requires rethinking how this surface is maintained.
3. False positive feedback velocity. How quickly do investigation outcomes feed back into detection tuning? In most SOCs, this loop runs on human memory and quarterly review cycles. The target state is continuous: investigation outcomes should flow directly into detection optimization, suppressing noise and improving signal without waiting for a scheduled review.
4. Hunt-driven detection creation rate. How many permanent detections were created from proactive hunting findings versus from incident response? This measures whether your hunting program is expanding your detection surface or just generating reports. The strongest implementations tie hunting directly to detection gaps where you run hypothesis-driven hunts against the techniques with the weakest coverage, then convert confirmed findings into permanent detection rules.

These measurements only matter once AI is doing real investigation work, but they represent a fundamentally different view of SOC performance that’s oriented around security outcomes rather than operational throughput.

The Mythos disclosure crystallized something the security industry already knew but hadn’t fully internalized: AI is accelerating offense at a pace that makes human-speed investigation untenable. The response isn’t to panic about AI-generated exploits. It’s to close the gap where defenders are actually slow — the post-alert investigation window — and to start measuring whether that gap is shrinking.

The teams that shift from reporting detection speed to reporting investigation coverage and detection improvement will have a clearer picture of their actual risk posture. When attackers have AI working for them, that clarity matters.

Prophet Security’s Agentic AI SOC Platform investigates every alert with senior analyst depth, continuously optimizes detections, and runs directed threat hunts against coverage gaps. Visit Prophet Security to see how it works.