Mean time to repair
11
MENTIONS
6
EPISODES
6
PODCASTS
Search complete. 11 mentions across 6 episodes found for "Mean time to repair".
Oct 29, 2026
Hannah FoxwellGUEST
And we've seen it.
Hannah FoxwellGUEST
We've seen so many high profile companies have very high profile outages because the volume of change moving through their systems and into production it makes it very very difficult to to to triage and fix like one of those like one in a million uh one in a million defects um that's like 100 levels down so yeah i think um I think I would say that like looking at cycle time, like things like MTTR, but also saturation, saturation of your system.
Hannah FoxwellGUEST
Have we moved too much change through this system at the same time? And finding out where the balance is between speed and safety, not just measuring the speed side of things.
Chris RomeoHOST
So just to, as we start to wrap up here, Hannah, what's one behavior that that you would want to see developers and AppSec people adopt as AI becomes the norm for how we build software?
Barnaby NickelsGUEST
Thanks, Tom.
Barnaby NickelsGUEST
For me, it's all about remediation time, MTTR.
Barnaby NickelsGUEST
I think that has to be the focus for organisations.
Barnaby NickelsGUEST
It's not easy, 90-day average at the moment, and there are different averages dependent on your source, but it's weeks and months.
Christy PunchGUEST
I think what I have found is that a lot of the tooling in this space has really kind of focused on IT operational use cases.
Christy PunchGUEST
Reduce support tickets and improve MTTR and really focus on outcomes that are really important for IT organizations, but maybe not so important for the broader business or maybe for employees.
Christy PunchGUEST
And so I'm a big advocate that DEX tools should be not just for IT teams.
Christy PunchGUEST
They really should be scaled across the business so that you have collaboration with IT, HR, security, finance, all of the functions that play a role and have an important role in those end-to-end employee experiences.
Snehal AntaniGUEST
And so with that, when I think about metrics, the first and foremost, what risks have we mitigated and what risks are we still accepting? That is no matter what the punchline of any conversation I have with leadership.
Snehal AntaniGUEST
Number two, how many problems do we have and how quickly are we actually fixing them? MTTR.
Snehal AntaniGUEST
And what are the trends of that remediation pace? Are we fixing things faster? Are we slowing down? What's going on there? What is the trend of that MTTR metric? How effective are we at detection and response? And what is the trend? Does it take us seven hours to react to a no-notice pen test? Or are we able to actually do something about it within five minutes? What about a honey token that gets triggered? How quickly are we able to actually do something to accelerate incident response to that tripped honey token? What's going on there? So MTTR over time, MTTD over time.
Snehal AntaniGUEST
Reoccurrence rate is something people don't really pay attention to.
Snehal AntaniGUEST
Now we start to get more into kind of the nerd side, but it's still important.
Snehal AntaniGUEST
I fixed a problem.
Snehal AntaniGUEST
30 days later, it's back.
Snehal AntaniGUEST
What happened? What is that reoccurrence rate for a particular issue? So if you can articulate the risk you're accepting, if you can understand and articulate MTTR over time, MTTD over time, and recurrence rate over time, you've got four really good aspects of your security program.
Ely AbramovichGUEST
Basically, everything in security becomes operations now.
Ely AbramovichGUEST
Like, everything has an MTTR and an SLA.
Ely AbramovichGUEST
Vulnerabilities need to be patched quickly.
Ely AbramovichGUEST
Misconfigurations need to be patched quickly.
20 MINS LATER
Ely AbramovichGUEST
So I don't know what's the right number.
Ely AbramovichGUEST
Like the right number is don't miss the important things.
Ely AbramovichGUEST
And they're also like MTTR alone is not enough.
Ely AbramovichGUEST
Like if I just close all my alerts, the MTTR would be very low, but I don't think it'll be more secure.
Nathan TaylorHOST
The automated tools are, that they're using are scary in that way.
Nathan OstrowskiGUEST
I have a lot of thoughts around MTTR.
Nathan OstrowskiGUEST
If you ever wanna get into some kind of like a deep conversation philosophically about MTTR, I'm happy to do that.
Nathan TaylorHOST
[laughs] I'd love to.
Nathan TaylorHOST
Maybe we'll have to do tho- that over, uh, over a drink someday.