Cyber Incident Dwell Time and MTTD/MTTR Cost Calculator
Dwell time is the gap between an attacker getting in and you noticing. This calculator prices that gap and the response that follows, so you can judge whether better monitoring pays for itself.
Your numbers
Incidents that reach hands-on investigation, not blocked alerts.
Data theft exposure, credential abuse and expanding scope while the attacker is unseen.
Internal labor, external responders, and disruption while containing.
Your results
Linear cost-per-day model. Severe incidents have step-change costs such as production stoppage that this simple model does not capture.
Annual incident cost vs mean time to detect
Sweeps Mean time to detect from 1 to 120, holding your other inputs fixed.
Detection coverage review
Optional review of detection gaps around ERP and plant systems.
Optional. The tool and every export work without this. No spam.
How to use it
Enter how many significant incidents you handle each year, your mean time to detect and your mean time to contain and recover. Assign a daily cost to being undetected and a separate daily cost to active response. Then enter the percentage reduction in detection time you expect from a proposed improvement and its annual cost. Pull MTTD and MTTR from your ticketing system rather than estimating.
- Measure MTTD from first malicious activity, not first alert.
- Use medians as a cross-check because outliers distort means.
- Keep incident definitions stable between periods.
The formulas
Cost per incident equals days undetected times the dwell cost plus days of response times the response cost. Annual cost equals incidents times that figure. The improved scenario reduces MTTD by the stated percentage and recomputes. Net benefit is the cost reduction minus the annual program cost, so a negative value means the investment does not pay on cost alone.
Reading the result
The chart shows annual cost rising linearly with detection time. The slope is your dwell cost multiplied by incident count, so the case for faster detection strengthens as either rises. If the benefit is small, the model is telling you response time or incident volume is the larger lever, and prevention controls may deserve the budget first.
Common mistakes
Do not claim detection improvements the tooling cannot deliver in your environment. Test with purple team exercises. Do not assume zero dwell cost for early detection: some damage happens in the first hours. Finally, include after-hours coverage, since many manufacturers run plants overnight while security staff do not, which silently inflates mean time to detect.
Frequently Asked Questions
What is a realistic dwell cost per day?
It varies widely. Estimate from the data and systems an intruder can reach, the likelihood of exfiltration and the cost of a longer investigation. Use a range and test sensitivity rather than one number.
How is MTTD different from dwell time?
They are close. Dwell time runs from initial compromise to detection, while MTTD is the average of that interval across incidents. Many teams use the terms interchangeably in reporting.
Can a managed service lower MTTD?
Often, especially for nights and weekends. Verify with measured results, response commitments and the detections they cover for your plant and ERP systems.
Why is MTTR separate?
Detection and response need different investments. Fast detection with slow containment still produces long incidents, so measure both and fix the longer one first.
If you want alerts triaged against ERP and plant context without sending logs to a third party, Netray can discuss a private on-prem approach.
Related Tools
Ransomware Recovery Time Objective Calculator
Estimate realistic hours to restore a plant after ransomware from data volume, restore speed, server rebuilds and validation.
ERP OperationsPatch Exposure Window Calculator
Quantify how many system-days per year you remain exposed after a critical vulnerability is exploited, based on your patch cadence.
Compliance & ContractsAnnualized Loss Expectancy Cyber Risk Calculator
Compute SLE, ALE and the net return of a security control so you can justify spend to finance in plain numbers.
Compliance & ContractsMFA Rollout Risk Reduction Calculator
Model how many account takeovers extending MFA to more users prevents, and whether the licence and support cost is justified.
More ERP Operations tools
See all- Vulnerability Backlog Burn-Down Calculator
- ERP License Audit Risk Assessment
- ERP Support Cost Benchmark Calculator
- IT Ticket Backlog Cost Calculator
- ERP Database Growth Forecaster
- ERP Performance Health Check
- Legacy Report Modernization Calculator
- ERP Security Posture Checklist
- ERP Disaster Recovery Readiness Assessment