TimetoDiscovery

Timetodiscovery, sometimes written as time to discovery or time-to-discovery, is a metric used to quantify the duration between the initiation of observation, data collection, or incident and the moment when a relevant discovery is made. In many contexts the endpoint is the confirmation of a finding, alert, or identification of a target, pattern, or anomaly. The term is used across disciplines such as cybersecurity, epidemiology, astronomy, and data science, with domain-specific interpretations of what constitutes "discovery" and the starting point.

Measurement typically defines the start as the earliest time data is generated or monitoring begins, and the end as the moment a discovery is verified by a system or human analyst. It can be reported as a time interval, sometimes aggregated as a distribution across events.

Factors influencing timetodiscovery include data latency, signal quality, coverage of monitoring, algorithmic efficiency, alert threshold settings, and the presence of human review. Shorter times generally indicate faster detection or discovery, but may increase false positives if thresholds are too aggressive; longer times may reduce noise but delay action.

Applications include evaluating detection pipelines, benchmarking security operations, monitoring outbreak surveillance, and assessing data-mining workflows. It is closely related to and sometimes used interchangeably with mean time to detect (MTTD) and detection latency, though those terms may have more specific definitions in particular fields.

No single standard definition exists; researchers tailor the metric to their context, data, and objectives.