Averages

An average hides the tail, and in security the tail is the entire story.

Mean time to detect of twelve days, made up of forty incidents found in an hour and one found after two years, describes nothing real. The outlier is the incident that mattered. Distributions and percentiles say something; a single average mostly reassures.